Analyst1 Suricata¶
The Analyst1 Suricata integration is designed to fetch Suricata rules from a specified sensor, of type “Suricata”, within the Analyst1 platform.
If the ‘interval_hours’ is set to 0, the integration will attempt to download additional content each time the Corelight-update service runs. See Configuration settings
Once downloaded, the ruleset will be processed with the rulesets from all other sources.
Settings¶
analyst1_suricata: client_id: "" # Analyst1 API Client ID client_secret: "" # Analyst1 API Secret url: "" # Analyst1 Base URL enabled: false suricata_sensor_id: 0 # Sensor ID with type Suricata debug: false ignore_tls: false request_limit: 1000 interval_hours: 1