ET rules are blocking or alerting

Security Intrusion Prevention
1

Anyone is familiar with the ET Community rules?
“Action: alert” means that they block traffic or just log and alert?

Whenever I see a strange one in the IPS log, I click on the reference SID, and try to see what is it about, and I always see the action says ALERT. So this ALERT information is on the ruleset provider’s website Proof pooint, not on the IPFire WUI,

Does it mean that this particular event was blocked or not blocked and only an alert was issued?

Here are some screenshots of the rules:
Here is a typical ET DROP Dshield:

ETdrop
ETdrop596×503 84.6 KB

and here is a in ET POLICY -potential corporate policy violation
ETpolicy

These are my settings
I have IPS enabled on RED and GREEN
and Subscribed to ET Community rules
“Monitor traffic only” is disabled.

2

If IPS is enabled and monitor is not checked.
It was blocked.
If it did not cause someone a problem
I would not worry about it.

2 Likes
3

Hello,

I also use ET rules, but on my machines above listed rules appears are DROP action.
A possible explanation can be the file /var/ipfire/suricata/oinkmaster-modify-sids.conf that contains some rules modification from alert to drop.

Example for the rules you listed above

/var/lib/suricata/emerging-dshield.rules:drop ip [89.248.165.0/24,193.201.9.0/24,45.155.205.0/24,185.156.73.0/24,91.240.118.0/24,80.82.64.0/24,45.143.203.0/24,91.191.209.0/24,193.163.125.0/24,185.196.220.0/24,141.98.10.0/24,92.63.197.0/24,146.88.240.0/24,45.154.96.0/24,78.128.113.0/24,89.248.163.0/24,138.99.216.0/24,45.135.232.0/24,94.102.61.0/24,192.241.213.0/24] any -> $HOME_NET any (msg:"ET DROP Dshield Block Listed Source group 1"; reference:url,feeds.dshield.org/block.txt; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; flowbits:set,ET.Evil; flowbits:set,ET.DshieldIP; sid:2402000; rev:6300; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag Dshield, signature_severity Major, created_at 2010_12_30, updated_at 2022_06_08;)

Hope it clarifies

1 Like
4

Thanks for the clarification H&M.
That was very useful
Now I see that a rule that says “Potential corporate violation”
is not just alert but a drop

drop http $EXTERNAL_NET any → $HOME_NET any

even an ET INFO. I assumed it will alert me only but
it shows as drop

drop http $HOME_NET any → $EXTERNAL_NET any (msg:"ET INFO DYNAMIC_DNS HTTP

Now I need to figure out which particular app is causing it.