netbird/plugins
0
0
Fork 0
mirror of https://github.com/netbirdio/plugins.git synced 2026-05-22 18:44:07 -07:00
Code Issues Packages Projects Releases Wiki Activity

Full ET open ruleset as open-extra (#3644)

Browse Source 
* Full ET open ruleset as open-extra

Follow up on #3635 to have full ET open ruleset as plugin

* Update et-open-extra.xml
This commit is contained in:
0nnyx
2023-10-31 10:43:25 +01:00
committed by GitHub
parent 806fb05c1c
commit d1eb2185ad
3 changed files with 58 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
security/intrusion-detection-content-et-open/Makefile
+2 -2
View File
@@ -1,7 +1,7 @@
PLUGIN_NAME= intrusion-detection-content-et-open
PLUGIN_VERSION= 1.0.1
PLUGIN_VERSION= 1.0.2
PLUGIN_REVISION= 1
PLUGIN_COMMENT= IDS Proofpoint ET open ruleset complementary subset for ET Pro Telemetry edition
PLUGIN_COMMENT= IDS Proofpoint full ET open ruleset complementary subset for ET Pro Telemetry edition
PLUGIN_MAINTAINER= ad@opnsense.org
PLUGIN_WWW= https://rules.emergingthreats.net/
security/intrusion-detection-content-et-open/pkg-descr
+2 -2
View File
@@ -1,5 +1,5 @@
IDS Proofpoint ET open ruleset duplicates rule files which are being
delivered empty in ET Pro Telemetry edition so both can be installed.
IDS Proofpoint ET open full ruleset to complement ET Pro Telemetry edition.
This plugin will trigger duplicate rules warnings in suricata logs when selecting the same categories for both ET open and ET Telemetry.
LICENSE: https://www.proofpoint.com/us/license
WWW: https://www.proofpoint.com/us/blog/threat-insight
security/intrusion-detection-content-et-open/src/opnsense/scripts/suricata/metadata/rules/et-open-extra.xml
+54 -10
View File
@@ -1,15 +1,59 @@
<?xml version="1.0"?>
<ruleset documentation_url="https://doc.emergingthreats.net/bin/view/Main/EmergingFAQ">
<location url="https://rules.emergingthreats.net/open/suricata-6.0/emerging.rules.tar.gz" prefix="ET open"/>
<version url="https://rules.emergingthreats.net/open/suricata-6.0/version.txt"/>
<location url="https://rules.emergingthreats.net/open/suricata-7.0/emerging.rules.tar.gz" prefix="ET open"/>
<version url="https://rules.emergingthreats.net/open/suricata-7.0/version.txt"/>
<files>
<file description="botcc.portgrouped" url="inline::rules/botcc.portgrouped.rules">et_open-botcc.portgrouped.rules</file>
<file description="botcc" url="inline::rules/botcc.rules">et_open.botcc.rules</file>
<file description="ciarmy" url="inline::rules/ciarmy.rules">et_open.ciarmy.rules</file>
<file description="compromised" url="inline::rules/compromised.rules">et_open.compromised.rules</file>
<file description="drop" url="inline::rules/drop.rules">et_open.drop.rules</file>
<file description="dshield" url="inline::rules/dshield.rules">et_open.dshield.rules</file>
<file description="tor" url="inline::rules/tor.rules">et_open.tor.rules</file>
<file description="emerging-inappropriate" url="inline::rules/emerging-inappropriate.rules">et_open.emerging-inappropriate.rules</file>
<file description="3coresec" url="inline::rules/3coresec.rules">3coresec.rules</file>
<file description="botcc.portgrouped" url="inline::rules/botcc.portgrouped.rules">botcc.portgrouped.rules</file>
<file description="botcc" url="inline::rules/botcc.rules">botcc.rules</file>
<file description="ciarmy" url="inline::rules/ciarmy.rules">ciarmy.rules</file>
<file description="compromised" url="inline::rules/compromised.rules">compromised.rules</file>
<file description="drop" url="inline::rules/drop.rules">drop.rules</file>
<file description="dshield" url="inline::rules/dshield.rules">dshield.rules</file>
<file description="emerging-activex" url="inline::rules/emerging-activex.rules">emerging-activex.rules</file>
<file description="emerging-adware_pup" url="inline::rules/emerging-adware_pup.rules">emerging-adware_pup.rules</file>
<file description="emerging-attack_response" url="inline::rules/emerging-attack_response.rules">emerging-attack_response.rules</file>
<file description="emerging-chat" url="inline::rules/emerging-chat.rules">emerging-chat.rules</file>
<file description="emerging-coinminer" url="inline::rules/emerging-coinminer.rules">emerging-coinminer.rules</file>
<file description="emerging-current_events" url="inline::rules/emerging-current_events.rules">emerging-current_events.rules</file>
<file description="emerging-deleted" url="inline::rules/emerging-deleted.rules">emerging-deleted.rules</file>
<file description="emerging-dns" url="inline::rules/emerging-dns.rules">emerging-dns.rules</file>
<file description="emerging-dos" url="inline::rules/emerging-dos.rules">emerging-dos.rules</file>
<file description="emerging-exploit" url="inline::rules/emerging-exploit.rules">emerging-exploit.rules</file>
<file description="emerging-exploit_kit" url="inline::rules/emerging-exploit_kit.rules">emerging-exploit_kit.rules</file>
<file description="emerging-ftp" url="inline::rules/emerging-ftp.rules">emerging-ftp.rules</file>
<file description="emerging-games" url="inline::rules/emerging-games.rules">emerging-games.rules</file>
<file description="emerging-hunting" url="inline::rules/emerging-hunting.rules">emerging-hunting.rules</file>
<file description="emerging-icmp" url="inline::rules/emerging-icmp.rules">emerging-icmp.rules</file>
<file description="emerging-icmp_info" url="inline::rules/emerging-icmp_info.rules">emerging-icmp_info.rules</file>
<file description="emerging-imap" url="inline::rules/emerging-imap.rules">emerging-imap.rules</file>
<file description="emerging-inappropriate" url="inline::rules/emerging-inappropriate.rules">emerging-inappropriate.rules</file>
<file description="emerging-info" url="inline::rules/emerging-info.rules">emerging-info.rules</file>
<file description="emerging-ja3" url="inline::rules/emerging-ja3.rules">emerging-ja3.rules</file>
<file description="emerging-malware" url="inline::rules/emerging-malware.rules">emerging-malware.rules</file>
<file description="emerging-misc" url="inline::rules/emerging-misc.rules">emerging-misc.rules</file>
<file description="emerging-mobile_malware" url="inline::rules/emerging-mobile_malware.rules">emerging-mobile_malware.rules</file>
<file description="emerging-netbios" url="inline::rules/emerging-netbios.rules">emerging-netbios.rules</file>
<file description="emerging-p2p" url="inline::rules/emerging-p2p.rules">emerging-p2p.rules</file>
<file description="emerging-phishing" url="inline::rules/emerging-phishing.rules">emerging-phishing.rules</file>
<file description="emerging-policy" url="inline::rules/emerging-policy.rules">emerging-policy.rules</file>
<file description="emerging-pop3" url="inline::rules/emerging-pop3.rules">emerging-pop3.rules</file>
<file description="emerging-rpc" url="inline::rules/emerging-rpc.rules">emerging-rpc.rules</file>
<file description="emerging-scada" url="inline::rules/emerging-scada.rules">emerging-scada.rules</file>
<file description="emerging-scan" url="inline::rules/emerging-scan.rules">emerging-scan.rules</file>
<file description="emerging-shellcode" url="inline::rules/emerging-shellcode.rules">emerging-shellcode.rules</file>
<file description="emerging-smtp" url="inline::rules/emerging-smtp.rules">emerging-smtp.rules</file>
<file description="emerging-snmp" url="inline::rules/emerging-snmp.rules">emerging-snmp.rules</file>
<file description="emerging-sql" url="inline::rules/emerging-sql.rules">emerging-sql.rules</file>
<file description="emerging-telnet" url="inline::rules/emerging-telnet.rules">emerging-telnet.rules</file>
<file description="emerging-tftp" url="inline::rules/emerging-tftp.rules">emerging-tftp.rules</file>
<file description="emerging-user_agents" url="inline::rules/emerging-user_agents.rules">emerging-user_agents.rules</file>
<file description="emerging-voip" url="inline::rules/emerging-voip.rules">emerging-voip.rules</file>
<file description="emerging-web_client" url="inline::rules/emerging-web_client.rules">emerging-web_client.rules</file>
<file description="emerging-web_server" url="inline::rules/emerging-web_server.rules">emerging-web_server.rules</file>
<file description="emerging-web_specific_apps" url="inline::rules/emerging-web_specific_apps.rules">emerging-web_specific_apps.rules</file>
<file description="emerging-worm" url="inline::rules/emerging-worm.rules">emerging-worm.rules</file>
<file description="tor" url="inline::rules/tor.rules">tor.rules</file>
<file description="threatview_CS_c2" url="inline::rules/threatview_CS_c2.rules">threatview_CS_c2.rules</file>
</files>
</ruleset>