In this demo,
we're going to look at the Snort configuration file and make a change to
the HOME_NET variable to reflect our internal network.
Let's head over to our Snort server and get started.
All right, let's pull up the Snort configuration file snort.lua.
The first thing you might notice appear at the top is that
Snort version 3 is also referred to as Snort++.
This first part is just header information.
If this is your first time using Lua,
the two dashes designate a comment in the file.
This file is broken down into eight different sections, all listed here.
We'll start with the defaults where we want to focus for right now.
Right here in the defaults is the HOME_NET and EXTERNAL_NET variable.
I've already changed HOME_NET to reflect my internal network of 10.0.0.0/24.
These include files are where we can store extra commands and
information for Snort to pull from, and using an include statement in
our snort.lua file tells Snort to go out and find the information in
these files. The snort_default.lua file is where we store default
information we want Snort to follow, like file paths for directories
that contain our rules.
File_magic.lua contains the default file processing
information for Snort. Then in configure inspection,
you'll see a list of different modules.
We're going to configure these plugins in the next module,
where we explore some of Snort's additional features.
If you followed the install guide,
you already plugged in a little bit of information here in the
appid section, to allow us to detect Facebook.
This next section is where we configure bindings.
Changing any of this information configuration is
beyond the scope of this course, but if you're interested,
the Snort manual might be able to point you in the right
direction for this topic. Performance tweaking is also
beyond the scope of this course,
and again I would refer you to the manual if you're
interested in making any changes here. Under the ips area
of the configure detection section,
we can tell Snort to use additional rules files.
We'll be visiting this shortly in this module.
Section six covers event filters. In this section, we can
change the behavior for events suppression,
event filtering, and rate filtering. These are options we would
use to suppress what we'll call noisy alerts.
The more community rules and registered rules you enable,
the greater your chances are of running into some false positives that
you might want to suppress in here, unless they reach a certain rate or
a certain limit that indicates potentially malicious traffic. The
configure outputs section is where we can adjust the variables for
different output plugins to change the format of our output. And this
last section is called configure tweaks where you can make a few other
changes.