[Autogenerated] Alright now that we have the extras
package built and installed properly.
Let's go explore it and better yet,
let's check out one of the example plugins Alright,
now let's add on to this.
Let's look for statistics for the different applications in the network.
Now keep in mind we're about to use the Snort Plus Plus extras this original
app IDE plugin it came default with snort but it wasn't activated yet and we
just activated it and created a rule to detect Twitter So now let's go ahead
and modify our snort dot lua again.
Now, just underneath where we configured the app I.
D section, we're gonna go ahead and add in an app IDE listener.
All right, and your configuration should look something similar to this.
You can designate a different file if you want to to have the listener log its
information to but I'm just using this one right here now.
I'll save it and exit now before we actually turn that on and use it now
we need to turn it on and use it to do So I'm just gonna stop snort real
quick and let's check the status real quick.
Okay,
it's an active so I have my snort service starting
up with a typical startup script.
Calling the plugins and the configuration files that I'm using in my
environment to add on an additional plugin we'll need to add that to
the startup script or to whatever.
Starting snort whether it's a command or a script or you're starting it in
some other way and so you can modify those startup scripts and stuff like
that to include the plugins that we just added when we installed these snort
Plus Plus extras package or you could just type out the command and have it
run on its own that way.
And so that's what we're gonna do.
I stopped the service and now we're just gonna run a single instance of snort
using the command to run it with my configuration files.
So that's my snort command to get the system up and running and we're
gonna add on another piece of it called the plugin path.
Now remember where the installation put all of our plugin extras,
it was this directory.
So this is where we actually add that information in and looking at this.
It's already collecting some information.
Right, let's go ahead and go to Twitter again.
Let's go ahead and stop snort then.
All right.
And now that snort has exited.
As you can see we have some applications that were detected
as well under the app IDE statistics,
so that's really cool that we're able to see that we have
the number of payloads that were detected,
We have what the applications were and as you can see we
have the twitter one right there for one and then a whole
bunch of DNS ones HTTPS one, so on and so forth.
So it's really cool that we could see that Alright.
The last thing that I wanted to show you is some of the other plug
ins that are available with the extras package.
So let's go ahead and do this Snort command and then list the
plugins and wow look at all these that are available like I said
before we have some that are policy selectors,
some that are search engines, some loggers,
some I.
P.
S options even and then additional inspectors and codex here.
So this extras pack gives us plenty of plugins to play with and on top of that
we have all of these snort default plugins that we can use as well keep in mind
that you can always look at the documentation for what plugins are available
where they are and how to use them so you can tie your own applications into
them or create additional capabilities yourself using these templates or
defaults so keep that in mind.
And now we have our system that's operational with application detectors,
JSON logging and some additional plugin capabilities that
we downloaded with the extras package for things like
statistics around the applications.
I'm so glad that we were able to see that app IDE plugin work.
There are so many different things that you can do with the snort plugins they
truly make the tool more and more useful in this module.
We learned all about the Snort plus plus extras package
or the snort three extras package.
This is a set of free plugin examples that work with one of
snorts over 200 plugins we learned how to install it and how to
configure it for use with the app.
IDE Inspector to collect application stats.
We'll be wrapping up the course soon, but before we do,
we have a bit more to cover.
Managing rules and rule sets can be difficult.
So you'll learn all about a tool called Polled port join me
in the next module to learn all about it.