Would you like to learn how to detect potential
threats to your networks using Snort?
Do you want to learn how to write your own Snort
rules to detect specific threats?
Hello,
I'm Matt Glass, and in this course, I'll be addressing all those desires
and more as we dive deeper and into Snort's configuration by writing our
own custom rules. We'll be exploring Snort's rule structure, options you
can leverage, and how to leverage new features available in Snort
version 3. Along the way, we'll configure custom rules in a lab
environment to detect specific traffic and threats that we'll use to
test our rules.
This module is a quick overview of the course,
along with a guide to writing your first custom rules.
Let's go to the overview and take a closer look at
what we'll cover in this module.
This course starts out with an introduction to the
lab setup I'm using in this course,
followed by a discussion on why we want to write
our own rules in the first place.
If you watched the getting started course,
you're already familiar with some of the available sources of freely
provided or paid subscription Snort rule sources.
This discussion will focus on why we would not want to exclusively rely on
these rule sets and instead create our own custom rules.
After that,
we'll cover the basic structure of a Snort rule and use
this to write your first custom rule.
We won't stop with just one rule in this module.
Instead,
we'll go through a scenario where we need to create a custom rule set to
detect specific traffic. Once we create the desired rule set, we'll test
our custom rules by sending the targeted traffic to see if we generate
alerts. Before we get into those capabilities, let's go over the
scenario for this course.
In our scenario,
you're working for Globomantics, which is a large global
corporation looking to expand into new regions.
As they expand and open new office spaces,
their computer network has grown significantly.
Recent cyber attacks on other companies have them worried
that they might be the next victim.
They hired you as their security engineer and want you to configure their
Snort server to detect potential threats to their network.
You decide that to maximize Snort's effectiveness,
you want to write custom rules to detect specific
threats to Globomantics' network.
Globomantics agrees to this approach and decides to provide you with a test
Snort environment where you're in control of the Snort server,
a copy of a vulnerable machine, and a Kali Linux
machine to simulate potential attacks.
This environment will allow you to create custom rules and focus
on the results of a single rule or a small set of rules without
impacting the production network.
Now that we covered the module overview and course scenario,
we're ready to move into the next clip where we'll introduce the lab
environment that we'll use throughout the rest of this course.