Rules

Security Onion supports three main types of rules: NIDS, Sigma, and YARA. You can manage all three types via Detections.

• NIDS
  • Managing Existing NIDS Rules
  • Enabling and Disabling with Regex
  • Tuning Overrides
  • Adding New NIDS Rules
  • Update Frequency
  • Allow External Access to NIDS Rules
  • Configuring Rulesets
  • Common Ruleset Configurations
  • ETPRO in Airgap Environments
  • Flowbit Dependency Handling
  • Sync Block
• Sigma
  • Managing Existing Sigma Rules
  • Adding New Sigma Rules
  • Sigma Configuration
• YARA
  • Managing Existing YARA Rules
  • Adding New YARA Rules
  • YARA Rules Options