Welcome to the last module for this course,
where we'll introduce a few features available in Snort version 3,
which allows us to incorporate app detection and
file processing into our rule sets.
Let's look at the overview and see what we'll cover in this module.
First up, we're going to go over two new options in Snort version 3,
active response and app id.
Active response allows us to configure rules that take a more active role by
injecting responses into potentially hostile traffic streams.
We've been using one of these options already,
reject, to insert TCP resets into the traffic stream.
There are two new ones we'll discuss in this module, react and rewrite.
App id allows Snort to identify the application responsible for the
traffic and take rule actions based on this value.
This can be used to provide more specific instructions support rules,
or as you saw if you watched the Getting Started course,
potentially enforce internal acceptable use policies.
After discussing these features,
we'll move on to Snort's file processing capabilities and
discuss processing files by type and hash value.
We'll use this last feature to create a file blacklist that prevents
files from being transmitted into our network. After file
processing, we'll discuss a few guidelines for rule writing before
wrapping up with the course summary.
If you're ready to get started,
we'll begin with the Snort version 3 options for
active response and app identification.