Rules

The rules command group manages detection rules, threat feed updates, and synchronization to sensor nodes.

---

Available actions

Action	Description
deploy	Deploy active Suricata rules and compiled IOC datasets to sensors.
fetch	Download and update rules from configured threat intelligence feeds.

---

Deploy rules

Push compiled rules and datasets to sensors:

# Deploy to all sensors
suricatavel rules deploy all

# Deploy to a specific sensor
suricatavel rules deploy sensor-01

---

Fetch rules from feeds

Download the latest rule sets and threat intelligence feeds:

# Normal fetch (respects schedules and HTTP cache)
suricatavel rules fetch

# Force full re-download (bypasses schedules and caches)
suricatavel rules fetch --force

Options

• --force: Ignore cached responses and download all feeds from scratch.