[Autogenerated] Welcome back we covered a lot in the previous
module with the pre processor discussion,
we'll continue our discussion about extending snorts
capabilities in this one by talking about the snort.
plugins Plugins were introduced in snort version 1.5.
That was a while ago and they're still used extensively today.
In fact they've only become better and better.
The plugin started out as either detection, plugins or pre processors.
We already covered the ladder a lot detection.
plugins though are looking for a single aspect of a packet With Snort
three were able to utilize the full plugin system.
Snort to for context only provided pre processor and
output plugins So we have more to work with here if you're
programming savvy and you know,
C++ or lua you can develop your own plugins snort provides
the plugin examples that will work with later in the module
to assist with the process.
These example,
plugins are great because they allow you to test out pre built ones and
see how they operate with snore in your environment.
They're free to download and use as well.
So what do plugins actually provide us though.
Take that output plug an example that we discussed earlier
in the course it provides a way to get the data to you or
whatever entity wants it.
You can create the CSV files,
create logs in many formats including JSON create a TCP dump file and
there's many other ways to get the data to you.
These are all plugins they're written for their specific purposes and only
turned on or modified when the situation or use case permits In Snort three
you can plug different areas of snort operations.
You can use the codec plugins to encode and decode protocols.
The data plugin provides more configurations to use
with the pre processors or inspectors.
You can plug your own inspector just like you could
with the pre processors and snort too.
Plugging the I PS options and I.
P.
S.
Actions are possible as well as the search engine for faster pattern matching.
Finally,
in snort three you can use plugins with the event handlers which
are the outputs like we discussed and the S.
O.
Rules which are those dynamic rules.