Suricata 7.0.8_2
I don’t think that the problem is suricata.
IMPORTANT NOTE:
I decide to try to understand the problem by myself:
I used curl command:
curl -H "Authorization: Bearer <mytoken>" https://opnsense.emergingthreats.net/api/v1/ruleset/engine/suricata/5 --output rules.tar.gz
I extracted the rules.
AND
-rw-r--r-- 1 l0rdg3x l0rdg3x 0 19 mar 05.16 botcc.rules
-rw-r--r-- 1 l0rdg3x l0rdg3x 0 19 mar 05.16 ciarmy.rules
-rw-r--r-- 1 l0rdg3x l0rdg3x 3,2K 19 mar 05.10 classification.config
-rw-r--r-- 1 l0rdg3x l0rdg3x 0 19 mar 05.16 compromised.rules
-rw-r--r-- 1 l0rdg3x l0rdg3x 0 19 mar 05.16 drop.rules
-rw-r--r-- 1 l0rdg3x l0rdg3x 0 19 mar 05.16 dshield.rules
-rw-r--r-- 1 l0rdg3x l0rdg3x 0 19 mar 05.16 emerging-3coresec.rules
-rw-r--r-- 1 l0rdg3x l0rdg3x 0 19 mar 05.16 emerging-activex.rules
-rw-r--r-- 1 l0rdg3x l0rdg3x 351K 19 mar 05.16 emerging-adware_pup.rules
-rw-r--r-- 1 l0rdg3x l0rdg3x 74K 19 mar 05.16 emerging-attack_response.rules
-rw-r--r-- 1 l0rdg3x l0rdg3x 0 19 mar 05.16 emerging-botcc_portgrouped.rules
-rw-r--r-- 1 l0rdg3x l0rdg3x 7,6K 19 mar 05.16 emerging-chat.rules
-rw-r--r-- 1 l0rdg3x l0rdg3x 14K 19 mar 05.16 emerging-coinminer.rules
-rw-r--r-- 1 l0rdg3x l0rdg3x 9,0K 19 mar 05.16 emerging-current_events.rules
-rw-r--r-- 1 l0rdg3x l0rdg3x 46K 19 mar 05.16 emerging-deleted.rules
-rw-r--r-- 1 l0rdg3x l0rdg3x 9,4K 19 mar 05.16 emerging-dns.rules
-rw-r--r-- 1 l0rdg3x l0rdg3x 13K 19 mar 05.16 emerging-dos.rules
-rw-r--r-- 1 l0rdg3x l0rdg3x 489K 19 mar 05.16 emerging-exploit_kit.rules
-rw-r--r-- 1 l0rdg3x l0rdg3x 293K 19 mar 05.16 emerging-exploit.rules
-rw-r--r-- 1 l0rdg3x l0rdg3x 0 19 mar 05.16 emerging-ftp.rules
-rw-r--r-- 1 l0rdg3x l0rdg3x 6,9K 19 mar 05.16 emerging-games.rules
-rw-r--r-- 1 l0rdg3x l0rdg3x 113K 19 mar 05.16 emerging-hunting.rules
-rw-r--r-- 1 l0rdg3x l0rdg3x 0 19 mar 05.16 emerging-icmp_info.rules
-rw-r--r-- 1 l0rdg3x l0rdg3x 0 19 mar 05.16 emerging-icmp.rules
-rw-r--r-- 1 l0rdg3x l0rdg3x 0 19 mar 05.16 emerging-imap.rules
-rw-r--r-- 1 l0rdg3x l0rdg3x 0 19 mar 05.16 emerging-inappropriate.rules
-rw-r--r-- 1 l0rdg3x l0rdg3x 2,2M 19 mar 05.16 emerging-info.rules
-rw-r--r-- 1 l0rdg3x l0rdg3x 3,3K 19 mar 05.16 emerging-ja3.rules
-rw-r--r-- 1 l0rdg3x l0rdg3x 6,9M 19 mar 05.16 emerging-malware.rules
-rw-r--r-- 1 l0rdg3x l0rdg3x 0 19 mar 05.16 emerging-misc.rules
-rw-r--r-- 1 l0rdg3x l0rdg3x 612K 19 mar 05.16 emerging-mobile_malware.rules
-rw-r--r-- 1 l0rdg3x l0rdg3x 0 19 mar 05.16 emerging-netbios.rules
-rw-r--r-- 1 l0rdg3x l0rdg3x 16K 19 mar 05.16 emerging-p2p.rules
-rw-r--r-- 1 l0rdg3x l0rdg3x 581K 19 mar 05.16 emerging-phishing.rules
-rw-r--r-- 1 l0rdg3x l0rdg3x 419K 19 mar 05.16 emerging-policy.rules
-rw-r--r-- 1 l0rdg3x l0rdg3x 0 19 mar 05.16 emerging-pop3.rules
-rw-r--r-- 1 l0rdg3x l0rdg3x 0 19 mar 05.16 emerging-rpc.rules
-rw-r--r-- 1 l0rdg3x l0rdg3x 4,8K 19 mar 05.16 emerging-scada.rules
-rw-r--r-- 1 l0rdg3x l0rdg3x 0 19 mar 05.16 emerging-scada_special.rules
-rw-r--r-- 1 l0rdg3x l0rdg3x 33K 19 mar 05.16 emerging-scan.rules
-rw-r--r-- 1 l0rdg3x l0rdg3x 0 19 mar 05.16 emerging-shellcode.rules
-rw-r--r-- 1 l0rdg3x l0rdg3x 3,0K 19 mar 05.16 emerging-smtp.rules
-rw-r--r-- 1 l0rdg3x l0rdg3x 4,7K 19 mar 05.16 emerging-snmp.rules
-rw-r--r-- 1 l0rdg3x l0rdg3x 0 19 mar 05.16 emerging-sql.rules
-rw-r--r-- 1 l0rdg3x l0rdg3x 0 19 mar 05.16 emerging-telnet.rules
-rw-r--r-- 1 l0rdg3x l0rdg3x 0 19 mar 05.16 emerging-tftp.rules
-rw-r--r-- 1 l0rdg3x l0rdg3x 30K 19 mar 05.16 emerging-user_agents.rules
-rw-r--r-- 1 l0rdg3x l0rdg3x 4,4K 19 mar 05.16 emerging-voip.rules
-rw-r--r-- 1 l0rdg3x l0rdg3x 43K 19 mar 05.16 emerging-web_client.rules
-rw-r--r-- 1 l0rdg3x l0rdg3x 40K 19 mar 05.16 emerging-web_server.rules
-rw-r--r-- 1 l0rdg3x l0rdg3x 225K 19 mar 05.16 emerging-web_specific_apps.rules
-rw-r--r-- 1 l0rdg3x l0rdg3x 5,7K 19 mar 05.16 emerging-worm.rules
-rw-r--r-- 1 l0rdg3x l0rdg3x 173K 19 mar 05.16 telemetry_sids.txt
-rw-r--r-- 1 l0rdg3x l0rdg3x 0 19 mar 05.16 tor.rules
AND
ET compromised, ET drop, ET dshield are completely empty.
So please fix.
The rules are empty already in the tar.gz on your server.
Thanks!
PS:
@Freewheelin if you can do the same test, please. Thanks!
Also other rules are empty. Need to compare with ET Open.