From eb921d8e075f68c76cfaa40d0d542eaa565740ed Mon Sep 17 00:00:00 2001
From: Ad Schellevis <ad@opnsense.org>
Date: Tue, 9 Mar 2021 10:16:18 +0100
Subject: [PATCH] Services / Intrusion detection: add new Abuse.ch feed
 ThreatFox to detect indicators of compromise

---
 src/opnsense/scripts/suricata/metadata/rules/sslbl.xml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/opnsense/scripts/suricata/metadata/rules/sslbl.xml b/src/opnsense/scripts/suricata/metadata/rules/sslbl.xml
index 096796dc9..9b1f49af4 100644
--- a/src/opnsense/scripts/suricata/metadata/rules/sslbl.xml
+++ b/src/opnsense/scripts/suricata/metadata/rules/sslbl.xml
@@ -18,5 +18,9 @@
               description="URLhaus"
               documentation_url="https://urlhaus.abuse.ch/"
         >abuse.ch.urlhaus.rules</file>
+        <file url="https://threatfox.abuse.ch/downloads/threatfox_suricata.rules"
+              description="ThreatFox"
+              documentation_url="https://threatfox.abuse.ch/"
+        >abuse.ch.threatfox.rules</file>
     </files>
 </ruleset>