In this clip, we're going to discuss file processing in Snort version 3.
We're going to start by configuring file processing and
writing rules to process files by type.
To accomplish this,
we're going to leave our local.rules file behind and completely switch gears.
We need to do that, because file detection in version 3 is done with snort.lua,
our configuration file.
In addition to configuring our file rules and logging in snort.lua,
our file detection process also references file_magic.lua to detect file types.
We can leave this file with its default options.
It's basically a list of pre‑configured file types.
If we wanted, we could also add our own custom file types,
but that's beyond the scope of this course.
Let's take a closer look at the process Snort goes
through to detect these files.
When a file is sent to Snort, it has two options for processing the file.
The first option we'll configure is to process by file type.
To check the type,
Snort will reference the file_magic.lua file and determine if
the file matches any of the listed types.
If it matches a rule,
the corresponding file type id is used to then check for
file processing rules in snort.lua.
The rules in snort.lua can be configured to log the file transfer,
block the file in transit,
and even capture the file to the Snort server for further analysis,
or a combination of all three.
Using these capabilities, you can configure Snort to log certain types of files,
block other file types completely,
and capture other file types that are more likely to contain malicious content.
It's important to note that this capability is limited to certain protocols.
At the time this course was created,
file processing capabilities are limited to HTTP,
SMTP, IMAP, POP3, FTP, and SMB protocols.
Instead of showing you an example configuration,
we will dive right into a demo where we will set up file processing in
snort.lua and capture two different types of files.