From ec244ebe523d75b4be19e7faac8f906052f7baaa Mon Sep 17 00:00:00 2001
From: Ad Schellevis <ad@opnsense.org>
Date: Fri, 29 Jan 2016 19:33:04 +0100
Subject: [PATCH] (IDS) add ssl fingerprint blacklist and other abuse lists to
 standard. courtesy of abuse.ch (https://www.abuse.ch/)

---
 src/opnsense/scripts/suricata/metadata/rules/sslbl.xml | 10 ++++++++++
 1 file changed, 10 insertions(+)
 create mode 100644 src/opnsense/scripts/suricata/metadata/rules/sslbl.xml

diff --git a/src/opnsense/scripts/suricata/metadata/rules/sslbl.xml b/src/opnsense/scripts/suricata/metadata/rules/sslbl.xml
new file mode 100644
index 000000000..37b29e7b7
--- /dev/null
+++ b/src/opnsense/scripts/suricata/metadata/rules/sslbl.xml
@@ -0,0 +1,10 @@
+<?xml version="1.0"?>
+<ruleset>
+    <location url="https://sslbl.abuse.ch/blacklist/" prefix="abuse.ch"/>
+    <files>
+        <file url="https://sslbl.abuse.ch/blacklist/sslblacklist.rules" description="SSL Fingerprint Blacklist">abuse.ch.sslblacklist.rules</file>
+        <file url="https://sslbl.abuse.ch/blacklist/sslipblacklist.rules" description="SSL IP Blacklist">abuse.ch.sslipblacklist.rules</file>
+        <file url="https://sslbl.abuse.ch/blacklist/dyre_sslipblacklist.rules" description="Dyre SSL IPBL">abuse.ch.dyre_sslipblacklist.rules</file>
+        <file url="https://feodotracker.abuse.ch/blocklist/?download=suricata" description="Feodo Tracker">abuse.ch.feodotracker.rules</file>
+    </files>
+</ruleset>