In this clip, we're going to discuss post‑detection rule options,
focusing on three of the available options to
change the post‑processing behavior.
The three options we'll cover in this course are session,
tag, and detection_filter.
Let's go over each quickly before we look at some examples.
The first option we'll cover is detection_filter.
Detection_filter is used to set a rate limit before a rule is triggered.
This option is useful for limiting alerts or detecting attacks like brute‑force
attempts without generating alerts for legitimate logins.
The next option, session,
is used to output all session data after a rule is triggered.
This can be useful in monitoring Telnet or FTP sessions to capture more
than just the data that triggered the initial alert.
Although this option is valuable,
the computation and traffic delays are significant,
so the Snort manual recommends that this is used on pcap
files already captured in the logs, rather than on a live,
in‑line operation.
The tag option is used to configure additional
traffic based on a host or a session.
When tagging is configured,
it can be set to capture additional packets after a rule is triggered,
and bases this decision on either the host or the session itself.
Log traffic can be captured based on a number of seconds,
number of packets, or number of bytes.
Now that we have a general idea of the options we'll cover,
let's look at two example rules using Session and Tag,
since we'll not be using those options in this demo.
We will not be using these rules in the demo due to the
recommendations of Snort's manual for session,
and tags formatting differences between version 2 and version 3 of Snort.
We'll start with an example session rule.
This rule is a modification again of the VSFTP
backdoor rule we configured earlier.
Instead of resetting the connection,
this rule is set to generate an alert and uses the session
option to capture printable session data.
The next rule is an example of adding the Snort version
2 Tag option to our traceroute rule.
This configuration tells tag to track all traffic from the source IP
address that triggered this rule for the next 10 minutes.
This is valuable in tracking any follow‑on scans or actions from the
same IP address after the traceroute is complete.
In the upcoming demo,
we're going to add detection filters and write a new
rule to further secure our environment.