Jeff Geiger

Stub in ability to disable rules for `suricata-update`

1

**Reasoning:** Provide a simple way for folks to disable noisy/useless rules "out of the box". **Necessary steps:** Add `/etc/suricata/disable.conf` on provision. Add `--disable-conf /etc/suricata/disable.conf` to the `suricata-update` cron job. **Nice...

The file `/var/log/suricata-update.log` needs to be created with `suricata:suricata` permissions. Otherwise `suricata-update` cron fails.

There's an opportunity here to also bundle in some scripts that can be used to pull updates and create the repo metadata so the `/srv/rocksnm` local repo can be updated...

We're already adding ASN's to the `conn.log`, so it makes sense to add an indicator type to the Intel Framework to support it. I have the beginnings of this already....