In this clip,
we're going to discuss version 3 features that enable us to take
different actions or create rules for specific applications.
We'll explore active responses and the AppId module.
After this brief discussion,
we'll use each of these features in a demo to detect app usage and
inject a custom block page into the communication stream.
We'll start with active response.
Active response features enable Snort to interrupt potentially hostile traffic
flows and take additional actions that come in three forms.
The first response type is react.
The react option interrupts the communication stream, typically,
HTTP or HTTPS, and injects a custom HTML page,
which it sends to the source of the violating traffic.
This is useful for enabling Snort to block the violating traffic and send
a page notifying the offender of the unauthorized access without allowing
the request to reach its true destination.
The next option, reject, is one that we've been using throughout this course.
This active response type blocks the traffic and then injects
a TCP reset for TCP connections or an ICMP unreachable packet
for other connection types.
This interrupts the communication stream and informs the offending device of
the interruption rather than just dropping the packet.
You saw examples of when this happened,
and although we didn't see the information,
there's a reason our session is dropped in some of our tests.
The last active response feature in version 3 is rewrite.
The rewrite feature allows real writers to overwrite packet
content with new values they specify.
This can be used to modify potentially hostile traffic in
transit to produce a different result.
We're going to be using react in the next demo,
and we already saw examples of reject throughout this course.
The other feature we need to cover is AppId. If you watched the
Getting Started course, you're already somewhat familiar with
AppId and its ability to provide application identifiers to
Snort rules for processing.
If you didn't watch that course, this slide is for you.
You might have noticed an AppId notification in some of the
alerts displayed in the console. AppId contains pre‑defined
applications and allows for custom detectors.
It doesn't require any additional configuration to run if you just
want to base your rules on the pre‑defined apps. We can write
rules based on the usage of these apps and take actions to either
alert or block this traffic.
We'll use a combination of AppId and active response in the
next demo to enforce an internal use policy.