Well,
we've come to the end of this module using different rule options to
increase Snort rule effectiveness and precision.
Let's take a look at the summary for this module to review
what we've learned so far in this course.
We started out this module discussing the content rule option,
which we used to detect FTP backdoor attempts.
Our rule was configured to reject any attempts to send the
string of text that triggers the back door.
We use this rule to prevent a simulated attack from succeeding.
We then discussed the non‑payload detection options.
We configured rules that leveraged ttl, dsize, and flags
to detect specific types of traffic.
These allowed us to detect traceroutes, Nmap Xmas
scans, and block large ICMP packets.
Once we covered payload and non‑payload detection options,
we moved to post detection options including detection filters.
We were also able to use the detection filter to interrupt an
attempted brute force of the FTP user account.
This module covered a few options that gave us a lot more
flexibility in our rule configuration,
which allowed us to detect specific exploits and use Snort's rule options
to either just alert to their presence or block them completely. In the
next module, we'll expand our capabilities by introducing appid and Snort
version 3's file detection capabilities.