os-intrusion-detection-content-at-antiphishing: support external Suricata dataset files

Important notices
Before you add a new report, we ask you kindly to acknowledge the following:

• I have read the contributing guide lines at https://github.com/opnsense/plugins/blob/master/CONTRIBUTING.md
• I have searched the existing issues, open and closed, and I'm convinced that mine is new.
• The title contains the plugin to which this issue belongs

Describe the bug
The Antiphishing IDS/IPS content plugin currently installs the main
antiphishing.rules file, but the ruleset also depends on two external
Suricata dataset files:

• phishing.lst
• phishing_ips.lst

The rules reference these files using Suricata's dataset load syntax:

dataset:isset,phishing_domains,type string,load phishing.lst

and:

dataset:isset,phishing_ips,type ipv4,load phishing_ips.lst

On OPNsense 26.7.2_2, the .rules file is installed under:

/usr/local/etc/suricata/opnsense.rules/

but the dataset files are not made available there.

As a result, Suricata reports:

failed to set up dataset 'phishing_domains'

and:

failed to set up dataset 'phishing_ips'

The static signatures continue to load, but the dataset-backed signatures are inactive.

This appears to be an integration issue between the OPNsense IDS content updater and a Suricata ruleset that references external dataset files.

We are currently investigating the correct OPNsense-supported mechanism for distributing these auxiliary files and would prefer to follow the existing OPNsense architecture rather than introducing an Antiphishing-specific workaround.

To Reproduce

1. Install/enable os-intrusion-detection-content-at-antiphishing.
2. Enable the Antiphishing ruleset in Intrusion Detection.
3. Update/download the rules.
4. Reload Suricata.
5. Check the Suricata logs.
6. Observe errors for the phishing_domains and phishing_ips datasets.

The installed ruleset contains references to:

load phishing.lst

and:

load phishing_ips.lst

but the corresponding files are not available in the directory from which the ruleset is loaded.

Expected behavior
The plugin should install all files required by the Antiphishing ruleset, not only antiphishing.rules.

The expected installation is conceptually:

antiphishing.rules
phishing.lst
phishing_ips.lst

with the dataset files available from the path expected by Suricata's
relative load directive.

Screenshots

Relevant log files

Error -- failed to set up dataset 'phishing_domains'.
Error -- error parsing signature "alert dns $HOME_NET any -> any any
(msg:"AT DNS query to suspicious domain - Phishing"; dns.query;
dataset:isset,phishing_domains,type string,load phishing.lst; ...
sid=6000000...)" from file
/usr/local/etc/suricata/opnsense.rules/antiphishing.rules at line 6

Error -- failed to set up dataset 'phishing_ips'.
Error -- error parsing signature "alert ip $HOME_NET any -> any any
(msg:"AT IP dataset - Phishing"; ip.dst; dataset:isset,phishing_ips,
type ipv4,load phishing_ips.lst; ... sid=6000002...)" from file
/usr/local/etc/suricata/opnsense.rules/antiphishing.rules at line 10

on:

/usr/local/etc/suricata/opnsense.rules/antiphishing.rules

Additional context
The Antiphishing ruleset is designed to be consumed by Suricata as a
portable ruleset and is also integrated with other Suricata ecosystems.

The dataset files are intentionally kept separate from the .rules file
because they are Suricata datasets rather than Suricata signature files.

We are investigating whether the OPNsense plugin metadata already
provides a supported mechanism for declaring multiple files belonging to
the same ruleset/source, or whether support for auxiliary dataset files
needs to be added to the OPNsense IDS content infrastructure.

We would prefer to preserve the standard Suricata dataset layout rather
than rename dataset files to .rules solely to satisfy an OPNsense
file-extension convention.

Suricata-update itself has explicit handling for files that do not end in
.rules and for dataset filenames:

https://github.com/OISF/suricata-update/releases

In particular, the 1.3.1 changelog mentions:

• handling URLs of bare files that don't end in .rules;
• detecting dataset load;
• preserving dataset filenames;
• assigning unique filenames to source files, specifically including dataset files.

We are therefore trying to determine the appropriate OPNsense integration
pattern before making changes to the Antiphishing distribution format.

Environment

OPNsense 26.7.2_2
Architecture: amd64
Plugin: os-intrusion-detection-content-at-antiphishing
Suricata IDS
Interface: LAN
Mode: IDS (not IPS)

Start by tracing how os-intrusion-detection-content-at-antiphishing installs antiphishing.rules into /usr/local/etc/suricata/opnsense.rules/. Check the existing OPNsense IDS content mechanism and Suricata handling for phishing.lst and phishing_ips.lst. Done means both dataset files are available beside antiphishing.rules and Suricata reloads without the reported dataset errors.