{"action":"created","issue":{"url":"https://api.github.com/repos/StamusNetworks/scirius/issues/46","labels_url":"https://api.github.com/repos/StamusNetworks/scirius/issues/46/labels{/name}","comments_url":"https://api.github.com/repos/StamusNetworks/scirius/issues/46/comments","events_url":"https://api.github.com/repos/StamusNetworks/scirius/issues/46/events","html_url":"https://github.com/StamusNetworks/scirius/issues/46","id":101641199,"number":46,"title":"Custom rules not taken into account","user":{"login":"Suricata-tester","id":13850577,"avatar_url":"https://avatars.githubusercontent.com/u/13850577?v=3","gravatar_id":"","url":"https://api.github.com/users/Suricata-tester","html_url":"https://github.com/Suricata-tester","followers_url":"https://api.github.com/users/Suricata-tester/followers","following_url":"https://api.github.com/users/Suricata-tester/following{/other_user}","gists_url":"https://api.github.com/users/Suricata-tester/gists{/gist_id}","starred_url":"https://api.github.com/users/Suricata-tester/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Suricata-tester/subscriptions","organizations_url":"https://api.github.com/users/Suricata-tester/orgs","repos_url":"https://api.github.com/users/Suricata-tester/repos","events_url":"https://api.github.com/users/Suricata-tester/events{/privacy}","received_events_url":"https://api.github.com/users/Suricata-tester/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":13,"created_at":"2015-08-18T12:08:37Z","updated_at":"2015-08-20T14:38:45Z","closed_at":null,"body":"Hello,\r\n\r\nI am new to sciruis and I am trying to see my first alert, without any success.\r\nHere is my rule:\r\n\r\n`alert dns any any -> any any (msg:\"Test dns_query option\"; dns_query; content:\"google\"; nocase; sid:1;)`\r\n\r\nIf I issue this command:\r\n`cat /etc/suricata/rules/scirius.rules | grep \"Test dns_query option\"`\r\n\r\nI do find the alert:\r\n`alert dns any any -> any any (msg:\"Test dns_query option\"; dns_query; content:\"google\"; nocase; sid:1;)`\r\n\r\nBut, if I do some DNS traffic (ping google or browse to the website), I do not see any alerts... I see the traffic in the eve file (that is a good thing, isn't it?). How could I troubleshoot the problem?\r\n\r\nThank you very much!"},"comment":{"url":"https://api.github.com/repos/StamusNetworks/scirius/issues/comments/133033765","html_url":"https://github.com/StamusNetworks/scirius/issues/46#issuecomment-133033765","issue_url":"https://api.github.com/repos/StamusNetworks/scirius/issues/46","id":133033765,"user":{"login":"Suricata-tester","id":13850577,"avatar_url":"https://avatars.githubusercontent.com/u/13850577?v=3","gravatar_id":"","url":"https://api.github.com/users/Suricata-tester","html_url":"https://github.com/Suricata-tester","followers_url":"https://api.github.com/users/Suricata-tester/followers","following_url":"https://api.github.com/users/Suricata-tester/following{/other_user}","gists_url":"https://api.github.com/users/Suricata-tester/gists{/gist_id}","starred_url":"https://api.github.com/users/Suricata-tester/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Suricata-tester/subscriptions","organizations_url":"https://api.github.com/users/Suricata-tester/orgs","repos_url":"https://api.github.com/users/Suricata-tester/repos","events_url":"https://api.github.com/users/Suricata-tester/events{/privacy}","received_events_url":"https://api.github.com/users/Suricata-tester/received_events","type":"User","site_admin":false},"created_at":"2015-08-20T14:38:45Z","updated_at":"2015-08-20T14:38:45Z","body":"You mean with this rule I won't be able to see and test payload for specific content? So how should I do?"}}