Alright, we've come to the end of this Getting Started with Snort course,
and it's time for the course summary and discussion of where you go from here.
Let's start with that summary.
We started this course with an overview of what Snort is and what it's used for.
We discussed what it means when we call Snort a signature‑based
intrusion detection and prevention system and how Snort processes
its rules to detect potential attacks.
We also covered compatibility issues between Snorts Version 2 and Version 3,
including a tool, Snort to Lua, to help you update your
configuration and rules files from previous versions.
Once we got through the basics,
we started up Snort and obtained some community and registered rules
to get our server to a functional state quickly.
We then ran Snort in IDS mode and began testing the rules by
sending traffic from a Kali Linux machine. With community
rules loaded and tested successfully,
we began changing configuration based on goals in our scenarios.
We then moved into configuration of modules to enhance Snort's functionality.
We leveraged appid and port scan to detect applications and then map scans.
We tested these configurations by attempting to connect and run
and map scans against the internal network.
We finished up the module with the last step.
Output the file to JSON and view the alerts in a Kibana dashboard.
So now that you know the basics of running Snort and
how to modify its configuration, where do you go from here?
Well,
we barely scratched the surface on Snort's
customization and configuration options.
So the first thing you should do is continue experimenting with Snort
configuration changes. We only discussed two inspector modules,
and there were 45 at the time this course was created.
So you should also explore the other modules and begin
making configuration changes to those.
Make sure you test these in a lab environment to make sure
that your configuration changes worked.
Snort Version 3 is still being developed,
so you'll need to stay up to date on the latest changes in new Snort versions.
Finally,
we wrote some very simple rules in this course that probably
aren't best suited for production environments.
So the last step in your journey forward with Snort is to learn to write your
own custom rules and test these in a lab environment. There are rule writing
guides available to get you started on Snort's website.
Thank you for watching this Getting Started with Snort course.
I hope you enjoyed this course as much as I enjoyed creating it.
Hopefully you're leaving this course comfortable making
configuration changes and running Snort from the command line. If
you're new to command line environments, I also hope that this made
you more comfortable operating without the GUI. Good luck in your
information security journey, and I'll see you out there.