Welcome! This guide will walk you through integrating your tailored Suricata rules feed from Ticura into your security infrastructure.

Configure Your Feed at Ticura

To create your customized Suricata rules feed, please follow the steps outlined in our Getting Started Guide. This guide will walk you through the process of creating your personalized feed. At the end of the configuration process, please select:

• Target Format: Suricata Rules
• Authentication Method: API Key Important: Please save your API credentials securely, as you'll need them for the next step.

Integrate the Feed with Your Suricata Installation

Adding the Rule Feed

To enable automatic rule updates from Ticura, you'll need to add the download URL with authentication to your Suricata feed configuration. Run the following command:

suricata-update add-source ticura-rules https://api.ticura.io/v1/feeds/download/full?targetFormat=SURICATARULESV1 --http-header "x-api-key: YOURKEY"

Note: If you're working on a Linux/Unix system as a regular user, you may need to run this command with sudo. This command creates a new entry in your Suricata feed configuration. From now on, each time you run:

suricata-update

Suricata will automatically download the latest version of the rules provided by Ticura.

Managing Your Feed Sources

By default, Suricata automatically enables feeds added via the suricata-update command, so no additional action is required to start using your Ticura feed. To view enabled sources:

suricata-update list-enabled-sources

This command displays all currently enabled sources in your system. To disable the Ticura rules feed: If needed, you can disable the Ticura feed at any time by running:

suricata-update disable-source ticura-rules

Need Help? If you have any questions or encounter issues during setup, please don't hesitate to reach out to our support team.