Rules

Security Onion supports three main types of rules: NIDS, Sigma, and YARA. You can manage all three types via Detections.

• NIDS
  • Managing Existing NIDS Rules
  • Enabling and Disabling with Regex
  • Adding New NIDS Rules
  • Update Frequency
  • Allow External Access to NIDS Rules
  • Changing to a Different Ruleset
• Sigma
  • Managing Existing Sigma Rules
  • Adding New Sigma Rules
  • Sigma Configuration
• YARA
  • Managing Existing YARA Rules
  • Adding New YARA Rules
  • YARA Rules Options