Unable to modify threshold.conf

[stamusnetworks]

Unable to modify threshold.conf

[regit]

You need to edit the threadhold.config file in the config/suricata of your Amsterdam instance (below the directory given by the -d option).
Then you can or restart the Amsterdam instance or issue a docker command to restart suricata container (like docker restart ams_suricata_1).

[Eagleman7]

I used: docker exec -i -t ams_suricata_1 bash

Then i tried to edit /etc/suricata/threshold.config, after saving with :wq! (vim) i got an error about the file being read-only. ("threshold.config" E212: Can't open file for writing)

Where can I find the config/suricata folder? And you sure I need to edit the threadhold.config?

[regit]

You are not supposed to connect to the containers. All the config files that are supposed to be useful are exposed on the host system and have to be edited from here.

Regarding the installation directory of the Amsterdam insance it is given by the -doption. For instance if you have ran `amsterdam -d selks start'. Then the instance directory is the selks directory under the current working directory.

[Eagleman7]

Thank you for your explanation, I got it working now!

Maybe it would be nice to give us the ability to edit the threshold.config through scirius.

[regit]

Hi,
Thresholding in scirius is definitely on the to-do list. It may come really soon.
Le 23 févr. 2016 1:20 PM, Eagleman7 [email protected] a écrit :Thank you for your explanation, I got it working now!

Maybe it would be nice to give us the ability to edit the threshold.config through scirius.

—Reply to this email directly or view it on GitHub.