Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Ruleset Management Guidance

Ruleset limits, sourcing, tuning workflow, curated ruleset downloads, lifecycle management, and Suricata variable support.

Please see the Match FAQ and Match performance and ruleset optimization guidance for additional details.

Supported Limits

  • Vectra suggest using one ruleset per Sensor for easier management, though multiple are supported.

    • For ET rulesets, it’s preferable to use the emerging-all.rules file instead of per-category files.

  • Match supports uploading up to 25 unique rulesets per Brain, each of which may be assigned to run on one or multiple Sensors paired to that same Brain.

  • Each ruleset can be up to 200 MB in size.

  • Rule IDs in a ruleset are required to be a positive 32-bit integer.

    • ET rules and the Vectra Match Curated Ruleset use IDs in the 1,000,000 to 2,999,999 range.

    • IDs 9,000,000 to 11,999,999 are reserved for Vectra use.

    • Customer IDs must be below 9,000,000.

    • Customers must not duplicate rule IDs that are assigned to a Sensor, since Suricate will choose an arbitrary rule of the duplicates to use.

Ruleset Sourcing and Editing

Vectra provides a curated ruleset, but customers may use any Suricata rulesets they desire. For details on accessing and using the curated ruleset, see Vectra Match Curated Ruleset.

Vectra Match supports rulesets in the standard Suricata format. These rule files can be created manually, purchased commercially, or downloaded from a variety of free sources. The most common sources are:

  • Proofpoint’s Emerging Threats ET Open or ET Pro rulesets for free or commercial use respectively

  • Snort’s Talos

  • Rules provided by various ISAC’s (Information Sharing and Analysis Centers)

Customers can manage rulesets directly in the Vectra UI. Vectra recommends using the UI to modify rule thresholds, rather than editing rule files directly. This ensures your changes are preserved and automatically applied even as new ruleset updates are released. Rule modifications made through the UI are automatically layered on top of the latest ruleset file, so you no longer need to reapply them manually. For details, please see the Managing Vectra Match Rulesets KB article.

For advanced use cases, ruleset editing can be done outside of your Vectra deployment. Some common ruleset editors are IDSTower or Lawmaker

Ruleset collection and management can also be done with tools such as Suricata-update but keep in mind that you cannot use such a tool to upload rules to Vectra Match. This must be done via the Vectra UI or one of the Match APIs.

Vectra Match Workflow Script

Vectra has created a script that can be used in either Respond UX (RUX) or Quadrant UX (QUX) Match deployments to help automate ruleset management via API calls. The tool is available in Vectra’s public Github and can be forked and modified as required.

Vectra Match Curated Ruleset

Vectra provides a curated version of the ET Pro ruleset, typically on a daily basis, as a standard part of Match licensing. Vectra provides an initially tuned baseline policy to produce the best possible signal. Customers are encouraged to further tune the curated ruleset to their specific environment and goals. In addition to the curated ET Pro rules, Vectra’s curated ruleset will include rules that were created solely by Vectra.

Please see Vectra Match Curated Ruleset on the Vectra support site for more details.

  • Match customers in air gap deployments can download the Curated ruleset for subsequent upload to their deployment from the Vectra Support portal. Please see the Curated Ruleset link above for more details.

To download the curated ruleset from the Vectra UI:

  • Navigate in your Vectra UI to Configuration → COVERAGE → Vectra Match and click the Download Vectra Ruleset link.

To download the curated ruleset using the Match APIs (RUX, QUX):

Ruleset Lifecycle Management

Vectra recommends only using a single ruleset per Sensor for easier management, though we do support multiple rulesets per Sensor. The below is the recommended process to manage through ruleset changes.

  1. Upload a ruleset v1 to the Brain.

  2. Assign ruleset v1 to the Sensor(s). This operation also copies the ruleset to the Sensor(s).

  3. When a new v2 ruleset needs to be applied:

    1. Upload ruleset v2 to the Brain.

    2. Assign ruleset v2 the Sensor(s).

  4. Delete the v1 ruleset or delete the ruleset assignment per option a or b below.

    1. If no Sensor(s) need to continue running the v1 ruleset, delete the ruleset (this will also remove it from any Sensor(s) it was assigned to.

    2. If some Sensor(s) need to continue running the ruleset, delete the ruleset assignment for the Sensor(s) that no longer need to run the ruleset.

Per the Supported Limits, a Brain can support a maximum of 25 unique rulesets. When using the API, a multipart form object, rotate, can be used to make it easier to stay under this limit. Setting rotate to true will allow the Brain to delete the oldest unassigned ruleset when a 26th ruleset is attempted to be uploaded. If all rulesets are assigned to sensors or the rotate option is not used, when a 26th ruleset is attempted to be uploaded to the Brain, a 507 error stating More than 25 files are currently stored by Vectra Match. Please delete any unused files and try again will be returned.

Examples of deletion for rulesets or ruleset assignments are given in API Deployment Examples.

Use of Suricata Address Groups and Variables

When building rules, Vectra supports the use of HOME_NET, EXTERNAL_NET, PROXY_IPs, and EXCLUDE_NET.

How does Vectra populate the HOME_NET variable?

Vectra automatically populates the HOME_NET variable based on the configuration defined in the:

  • Internal IP Addresses (CIDR) - "Internal subnet"

    • Viewable in your Vectra UI at Configuration → COVERAGE → Data Sources → Network → Brain Setup → IP Address Classification

  • Excluded Subnet of Internal IP Addresses (CIDR) - "Excluded subnet"

    • Viewable in your Vectra UI at Configuration → COVERAGE → Data Sources → Network → Brain Setup → IP Address Classification

  • Automatically discovered Southside Proxy IPs

    • Viewable at the CLI of your Brain with show proxy --southside command.

  • For Example:

    • If you have 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 as your Internal subnets

    • And 10.0.0.1, 10.0.0.2, 10.0.0.3 as Southside Proxy IP's,

    • And you've excluded 10.254.1.0/24 in the Excluded subnet,

    • The HOME_NET variable would look like:

      • [10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16,!PROXY_IPs,!EXCLUDE_NET]

    • With PROXY_IPs being [10.0.0.1, 10.0.0.2, 10.0.0.3]

    • And EXCLUDE_NET would be [10.254.1.0/24]

Does Vectra support setting other variables besides HOME_NET?

In addition to the HOME_NET Variable, Vectra supports the following variables:

  • EXTERNAL_NET variable is [!HOME_NET, PROXY_IPs, EXCLUDE_NET]

  • PROXY_IPs is a list of IP's that are automatically added to the PROXY_IPs variable if detected by Vectra's Southside proxy detection.

    • Northside proxies are not factored in here.

    • This variable was introduced in 9.0 and enables users to automatically treat any traffic sent to Proxies as External even if they have an internal address.

    • You can view the list of Southside proxies on the Brain CLI using show proxy --southside

  • EXCLUDE_NET

    • The EXCLUDE_NET variable is automatically populated via the Excluded Subnet configuration under Configuration → COVERAGE → Data Sources → Network → Brain Setup → IP Address Classification

  • Customers may use any of the supported Variables (HOME_NET, PROXY_IPs, EXCLUDE_NET, and EXTERNAL_NET) in your own rules.

  • If you have further custom variables, you can always resolve them into the IP netblocks and use those in the rules instead, as this is all that Suricata does when a variable is in the Suricata.yaml file.

PreviousLicensingNextDeployment (UI and general guidance)

Last updated

Was this helpful?