[Autogenerated] the app IDE pre processor is one of my
favorites as it provides the application information for
the traffic passing in the network.
It's interesting how much the security landscape has evolved,
giving us the need to inspect some application traffic and know what
the apps are actually doing using this pre processor.
We're able to have application awareness using application identifiers or app I.
D.
S.
These application identifiers are available to use when writing snort rules.
We can also see how the application uses the network,
including band with information about them on top of that.
You can create your own application detectors for newer custom applications.
These are written in the lua language when enabling this pre processor,
there's a few requirements.
First, the stream pre processor for session tracking has to be enabled.
Protocol aware flushing and I P.
D fragmentation need to be enabled as well.
We'll also need to use the H G D p pre processor to be able to give F I.
D the http header information.
Also Luigi.
It must be installed.
There's a lot of documentation around the open app IDE pre
processor and corresponding application i.
D.
S.
In fact there's over 3000 different detectors in the most recent
releases that help us identify different traffic types.
There's some pop there's some for popular social media services for airplay.
Itunes Airbnb to name a few.
There's a lot of different application detectors available.
Check out this site at Cisco dot com.
To search through the various applications and take a look at the risk levels
and business relevance classifications using this information.
You can create and add context around the traffic.
For example, you can create a detection for users on a certain network segment,
navigating to a music streaming service that's against corporate
policy or prevent them from playing games that aren't supposed to
be played while on corporate devices.
This information is gold from the rule creating perspective and
really helps to build a story for a traffic.
It's easy to write a basic rule regarding the app.
IDE as shown here for slack.
Once you enable the pre processor,
you can use the app IDE rule option in your rules,
we'll see an example of this in the coming demo.