From d1eb2185ad2864078dfc8923d3dc08fc6e0f73c5 Mon Sep 17 00:00:00 2001
From: 0nnyx <54419678+0nnyx@users.noreply.github.com>
Date: Tue, 31 Oct 2023 10:43:25 +0100
Subject: [PATCH] Full ET open ruleset as open-extra (#3644)

* Full ET open ruleset as open-extra

Follow up on #3635 to have full ET open ruleset as plugin

* Update et-open-extra.xml
---
 .../Makefile                                  |  4 +-
 .../pkg-descr                                 |  4 +-
 .../suricata/metadata/rules/et-open-extra.xml | 64 ++++++++++++++++---
 3 files changed, 58 insertions(+), 14 deletions(-)

diff --git a/security/intrusion-detection-content-et-open/Makefile b/security/intrusion-detection-content-et-open/Makefile
index 453c803cc..e3b185e58 100644
--- a/security/intrusion-detection-content-et-open/Makefile
+++ b/security/intrusion-detection-content-et-open/Makefile
@@ -1,7 +1,7 @@
 PLUGIN_NAME=		intrusion-detection-content-et-open
-PLUGIN_VERSION=		1.0.1
+PLUGIN_VERSION=		1.0.2
 PLUGIN_REVISION=	1
-PLUGIN_COMMENT=		IDS Proofpoint ET open ruleset complementary subset for ET Pro Telemetry edition
+PLUGIN_COMMENT=		IDS Proofpoint full ET open ruleset complementary subset for ET Pro Telemetry edition
 PLUGIN_MAINTAINER=	ad@opnsense.org
 PLUGIN_WWW=		https://rules.emergingthreats.net/
 
diff --git a/security/intrusion-detection-content-et-open/pkg-descr b/security/intrusion-detection-content-et-open/pkg-descr
index 7065fc3ed..ef686238d 100644
--- a/security/intrusion-detection-content-et-open/pkg-descr
+++ b/security/intrusion-detection-content-et-open/pkg-descr
@@ -1,5 +1,5 @@
-IDS Proofpoint ET open ruleset duplicates rule files which are being
-delivered empty in ET Pro Telemetry edition so both can be installed.
+IDS Proofpoint ET open full ruleset to complement ET Pro Telemetry edition.
+This plugin will trigger duplicate rules warnings in suricata logs when selecting the same categories for both ET open and ET Telemetry.
 
 LICENSE: https://www.proofpoint.com/us/license
 WWW: https://www.proofpoint.com/us/blog/threat-insight
diff --git a/security/intrusion-detection-content-et-open/src/opnsense/scripts/suricata/metadata/rules/et-open-extra.xml b/security/intrusion-detection-content-et-open/src/opnsense/scripts/suricata/metadata/rules/et-open-extra.xml
index ae9c0bffc..e421e8796 100644
--- a/security/intrusion-detection-content-et-open/src/opnsense/scripts/suricata/metadata/rules/et-open-extra.xml
+++ b/security/intrusion-detection-content-et-open/src/opnsense/scripts/suricata/metadata/rules/et-open-extra.xml
@@ -1,15 +1,59 @@
 <?xml version="1.0"?>
 <ruleset documentation_url="https://doc.emergingthreats.net/bin/view/Main/EmergingFAQ">
-    <location url="https://rules.emergingthreats.net/open/suricata-6.0/emerging.rules.tar.gz" prefix="ET open"/>
-    <version url="https://rules.emergingthreats.net/open/suricata-6.0/version.txt"/>
+    <location url="https://rules.emergingthreats.net/open/suricata-7.0/emerging.rules.tar.gz" prefix="ET open"/>
+    <version url="https://rules.emergingthreats.net/open/suricata-7.0/version.txt"/>
     <files>
-        <file description="botcc.portgrouped" url="inline::rules/botcc.portgrouped.rules">et_open-botcc.portgrouped.rules</file>
-        <file description="botcc" url="inline::rules/botcc.rules">et_open.botcc.rules</file>
-        <file description="ciarmy" url="inline::rules/ciarmy.rules">et_open.ciarmy.rules</file>
-        <file description="compromised" url="inline::rules/compromised.rules">et_open.compromised.rules</file>
-        <file description="drop" url="inline::rules/drop.rules">et_open.drop.rules</file>
-        <file description="dshield" url="inline::rules/dshield.rules">et_open.dshield.rules</file>
-        <file description="tor" url="inline::rules/tor.rules">et_open.tor.rules</file>
-        <file description="emerging-inappropriate" url="inline::rules/emerging-inappropriate.rules">et_open.emerging-inappropriate.rules</file>
+        <file description="3coresec" url="inline::rules/3coresec.rules">3coresec.rules</file>
+        <file description="botcc.portgrouped" url="inline::rules/botcc.portgrouped.rules">botcc.portgrouped.rules</file>
+        <file description="botcc" url="inline::rules/botcc.rules">botcc.rules</file>
+        <file description="ciarmy" url="inline::rules/ciarmy.rules">ciarmy.rules</file>
+        <file description="compromised" url="inline::rules/compromised.rules">compromised.rules</file>
+        <file description="drop" url="inline::rules/drop.rules">drop.rules</file>
+        <file description="dshield" url="inline::rules/dshield.rules">dshield.rules</file>
+        <file description="emerging-activex" url="inline::rules/emerging-activex.rules">emerging-activex.rules</file>
+        <file description="emerging-adware_pup" url="inline::rules/emerging-adware_pup.rules">emerging-adware_pup.rules</file>
+        <file description="emerging-attack_response" url="inline::rules/emerging-attack_response.rules">emerging-attack_response.rules</file>
+        <file description="emerging-chat" url="inline::rules/emerging-chat.rules">emerging-chat.rules</file>
+        <file description="emerging-coinminer" url="inline::rules/emerging-coinminer.rules">emerging-coinminer.rules</file>
+        <file description="emerging-current_events" url="inline::rules/emerging-current_events.rules">emerging-current_events.rules</file>
+        <file description="emerging-deleted" url="inline::rules/emerging-deleted.rules">emerging-deleted.rules</file>
+        <file description="emerging-dns" url="inline::rules/emerging-dns.rules">emerging-dns.rules</file>
+        <file description="emerging-dos" url="inline::rules/emerging-dos.rules">emerging-dos.rules</file>
+        <file description="emerging-exploit" url="inline::rules/emerging-exploit.rules">emerging-exploit.rules</file>
+        <file description="emerging-exploit_kit" url="inline::rules/emerging-exploit_kit.rules">emerging-exploit_kit.rules</file>
+        <file description="emerging-ftp" url="inline::rules/emerging-ftp.rules">emerging-ftp.rules</file>
+        <file description="emerging-games" url="inline::rules/emerging-games.rules">emerging-games.rules</file>
+        <file description="emerging-hunting" url="inline::rules/emerging-hunting.rules">emerging-hunting.rules</file>
+        <file description="emerging-icmp" url="inline::rules/emerging-icmp.rules">emerging-icmp.rules</file>
+        <file description="emerging-icmp_info" url="inline::rules/emerging-icmp_info.rules">emerging-icmp_info.rules</file>
+        <file description="emerging-imap" url="inline::rules/emerging-imap.rules">emerging-imap.rules</file>
+        <file description="emerging-inappropriate" url="inline::rules/emerging-inappropriate.rules">emerging-inappropriate.rules</file>
+        <file description="emerging-info" url="inline::rules/emerging-info.rules">emerging-info.rules</file>
+        <file description="emerging-ja3" url="inline::rules/emerging-ja3.rules">emerging-ja3.rules</file>
+        <file description="emerging-malware" url="inline::rules/emerging-malware.rules">emerging-malware.rules</file>
+        <file description="emerging-misc" url="inline::rules/emerging-misc.rules">emerging-misc.rules</file>
+        <file description="emerging-mobile_malware" url="inline::rules/emerging-mobile_malware.rules">emerging-mobile_malware.rules</file>
+        <file description="emerging-netbios" url="inline::rules/emerging-netbios.rules">emerging-netbios.rules</file>
+        <file description="emerging-p2p" url="inline::rules/emerging-p2p.rules">emerging-p2p.rules</file>
+        <file description="emerging-phishing" url="inline::rules/emerging-phishing.rules">emerging-phishing.rules</file>
+        <file description="emerging-policy" url="inline::rules/emerging-policy.rules">emerging-policy.rules</file>
+        <file description="emerging-pop3" url="inline::rules/emerging-pop3.rules">emerging-pop3.rules</file>
+        <file description="emerging-rpc" url="inline::rules/emerging-rpc.rules">emerging-rpc.rules</file>
+        <file description="emerging-scada" url="inline::rules/emerging-scada.rules">emerging-scada.rules</file>
+        <file description="emerging-scan" url="inline::rules/emerging-scan.rules">emerging-scan.rules</file>
+        <file description="emerging-shellcode" url="inline::rules/emerging-shellcode.rules">emerging-shellcode.rules</file>
+        <file description="emerging-smtp" url="inline::rules/emerging-smtp.rules">emerging-smtp.rules</file>
+        <file description="emerging-snmp" url="inline::rules/emerging-snmp.rules">emerging-snmp.rules</file>
+        <file description="emerging-sql" url="inline::rules/emerging-sql.rules">emerging-sql.rules</file>
+        <file description="emerging-telnet" url="inline::rules/emerging-telnet.rules">emerging-telnet.rules</file>
+        <file description="emerging-tftp" url="inline::rules/emerging-tftp.rules">emerging-tftp.rules</file>
+        <file description="emerging-user_agents" url="inline::rules/emerging-user_agents.rules">emerging-user_agents.rules</file>
+        <file description="emerging-voip" url="inline::rules/emerging-voip.rules">emerging-voip.rules</file>
+        <file description="emerging-web_client" url="inline::rules/emerging-web_client.rules">emerging-web_client.rules</file>
+        <file description="emerging-web_server" url="inline::rules/emerging-web_server.rules">emerging-web_server.rules</file>
+        <file description="emerging-web_specific_apps" url="inline::rules/emerging-web_specific_apps.rules">emerging-web_specific_apps.rules</file>
+        <file description="emerging-worm" url="inline::rules/emerging-worm.rules">emerging-worm.rules</file>
+        <file description="tor" url="inline::rules/tor.rules">tor.rules</file>
+        <file description="threatview_CS_c2" url="inline::rules/threatview_CS_c2.rules">threatview_CS_c2.rules</file>
     </files>
 </ruleset>