Hello again, and welcome to the next module for this course where we
we'll be exploring Snort's features and modules.
In the previous module,
we got Snort up and running with community, built‑in, and
registered rules we obtained from snort.org.
Now that we have a rule base to build from,
we're ready to continue securing the network by expanding Snort's
functionality and exploring a few of the additional modules.
Let's take a look at the overview and see what we'll cover in
this module. In this module, we're going to start with an
overview of Snort's active response features,
as well as defining the function of Snort's basic modules
and codecs that enable it to function.
Then we'll move into the more customizable modules,
starting with the inspector modules.
We have a demo for two different modules that fall into
this category, AppId and Port Scan.
We'll discuss some of the configuration options available within each one
and how to make these changes. After exploring these two inspectors,
we'll end this lesson with a discussion on the logger modules, focusing
on the configuration of alert_json,
which we'll leverage later in this course. While this is far from a
comprehensive list of the modules we can configure in Snort, these will
provide you with a solid framework of how to modify modules and the
additional benefits they can provide.
Let's start by going over activating Snort's active response
features. Snort's active response options are configured
differently in Snort 3 and consist of reject,
react, and rewrite as active response options.
The first of these, reject, can shut down a potentially hostile connection
based on the number of attempts to access the network.
React performs a similar function, but can insert a new HTML page
into the stream before resetting the connection.
This page can either be the default included with
Snort or a customized page you create.
Rewrite is capable of replacing the contents of a
packet based on your configuration.
While we won't be leveraging these options in this course, I wanted to highlight
them as features of Snort that allow you to expand its functionality. Before
moving into the customizable modules, we also need to define the basic modules
and codecs. A basic module is any module that is not a plugin, but instead is
responsible for Snort's operation.
These include the alert module, detection module, and Snort module itself
that you can call from the command line. Codecs are responsible for
decoding of packet streams and anomaly detection.