Hi have come from a distro with Snort rather than Suricata and Snort generally places a high single core load on a processor. Suricata, I believe, is multi-core.
In the Emerging Threats databases there are a whole bunch of what are just IP blocks - 3coresec, drop, botcc.portgrouped, botcc, ciarmy, compromised, dshield and tor.
Because of the load Snort caused, I parsed all the above files and created ipset lists for them and blocked them directly in the firewall. It saves Snort from having to detect if there was any traffic to or from the IPās then adding a single IP blocking rule. With the ipset sets, all the IPs were permanently blocked.
Would it help if I did the same here, to relieve the load from Suricata?
Quite a lot of those IP Block Lists from the Emerging Threats suricata rulesets are covered by the IP Address Blocklists function such as dshield, ciarmy, emerging compromised
So you would be better off selecting them via the IP Blocklists rather than in the IPS.
The IP Address Blocklists has the Spamhaus drop list but this is covered by the Drop packets from and to hostile networks option in the firewall options section.
I confirm that. Alienvault was taken over by AT&T Security around 6 years ago and it looks like all old alienvault web pages have been progressively removed and replaced by AT&T pages on their own products which have to be paid for.
The link for the reputation.generic file that is used for the IP Blocklist is still available.
Searching on the AT&T Security site for reputation.generic gets you to a webpage on the alienvault OTX product.
I also found a posting from 4 years ago in the AT&T Security support area about some false positives in the reputation.generic file that were being used to feed into a blacklist and the response was
The root issue may be in expectations here. The OTX reputation list is not a blocklist. It is a reputation history for any domain or IP address in the database, including several information vectors collected from a number of sources, which is used to create a risk score for a particular address or domain. You can find an explanation of this in the following article, or in the OTX services documentation
given that the reputation list contains both current and previous activity, as well as other data, using the list as a strict blocklist is well outside the intended use of the service.
So this makes it sound like the list is not really appropriate for the IPFire IP Blocklist.
I am looking at the log summaries and IPB system log files, and I donāt see any updates being logged for the last 3 months , and never shows that list was updated just says,
ipblocklist: Skipping ALIENVAULT blocklist - It has not been modified!
I have checked the code and the .conf files are the places where the ipblocklists are stored in.
If you had a blocklist enabled but then disabled it then a .conf file will stay there with the status as when it was last updated.
If your ALIENVAULT.conf file is showing 2022-11-03 then either that is when it was last updated or when you first started using it, if the list is not being updated.
I am presuming that you still have the ALIENVAULT list enabled.
If so then the list is at least 16 months since it was last updated but could be even older if 2022-11-03 is when you first enabled that list.
I have compared your list dated 2022-11-03 to the current version that is downloaded and those initial lines you showed are identical.
I think this list should be removed from the IP Address Blocklists.