Where Does Suricata Store Rules and Config?
Suricata IDS config and rule folders on Linux for network threat detection sensors. Plus migration notes.
Last updated
Suricata keeps sensor settings in /etc/suricata/suricata.yaml with capture, outputs, and rule paths. That file is the sensor to back up.
Rule files live under /var/lib/suricata/rules from suricata-update runs. Logs land in /var/log/suricata with eve.json for SIEM shipping. Back up the config with custom rules. Stock rules refetch on demand. Outputs feed Elasticsearch directly. Thresholds hush noisy rules. PCAP logging aids forensics. Filestore extracts transferred files. Rules reload without restart.
Where Suricata stores this, by platform
/etc/suricata/suricata.yaml
Capture and output settings for the sensor. Test with suricata -T before reloading. Keep with custom rules for moves.
/var/lib/suricata/rules
Downloaded rule files from enabled sources. Custom rules sit in local.rules beside them. Refresh with suricata-update on schedule.
Frequently asked questions
what do i back up for a Suricata sensor move
Copy /etc/suricata with /var/lib/suricata for full moves. The config names rule files. Rules update with suricata-update. Both restore detection. Keep copies safe.
where are Suricata rules stored
Look in /var/lib/suricata/rules for downloaded rule files. Custom rules sit beside them. Updates refresh stock rules without touching customs. Test restores first.
Notice an outdated path? Let us know.