<!-- Suricata Rules -->
<group name="suricata,netflow">
        <rule id="100002" level="3">
                <if_sid>86600</if_sid>
                <options>no_full_log</options>
                <description>Suricata Traffic - $(event_type).</description>
        </rule>
</group>
<group name="suricata,suricata_severity2">
        <rule id="100003" level="10">
                <if_sid>86601</if_sid>
                <field name="alert.severity">2</field>
                <options>no_full_log</options>
                <description>Suricata Alert - $(alert.signature). Signature ID: $(alert.signature_id).</description>
        </rule>
</group>
<group name="suricata,suricata_severity1">
        <rule id="100004" level="12">
                <if_sid>86601</if_sid>
                <field name="alert.severity">1</field>
                <options>no_full_log</options>
                <description>Suricata Alert - $(alert.signature). Signature ID: $(alert.signature_id).</description>
        </rule>
</group>
<group name="suricata,suricata_severity3">
        <rule id="100005" level="5">
                <if_sid>86601</if_sid>
                <field name="alert.severity">3</field>
                <options>no_full_log</options>
                <description>Suricata Alert - $(alert.signature). Signature ID: $(alert.signature_id).</description>
        </rule>
</group>
<group name="suricata,suricata_http">
        <rule id="100006" level="3">
                <if_sid>86602</if_sid>
                <options>no_full_log</options>
                <description>Suricata HTTP Traffic.</description>
        </rule>
</group>
<group name="suricata,suricata_dns">
        <rule id="100007" level="3">
                <if_sid>86603</if_sid>
                <options>no_full_log</options>
                <description>Suricata DNS Traffic.</description>
        </rule>
</group>
<group name="suricata,suricata_tls">
        <rule id="100008" level="3">
                <if_sid>86604</if_sid>
                <options>no_full_log</options>
                <description>Suricata TLS Traffic.</description>
        </rule>
</group>
<group name="suricata,active_response,">
 <rule id="100009" level="3">
    <location>wazuh_suricata</location>
    <description>Wazuh Suricata Blocked IP</description>
    <options>no_full_log</options>
  </rule>
</group>
