[Autogenerated] it's time to talk about one of the topics
that's on everybody's mind the rules or more specifically
the rule management piece.
Think about it, you might have a lot of rules to the tune of thousands.
How do you keep them all straight and manage them properly?
We're going to learn about one very specific rule management
tool called Polled port three in the next clip,
but let's take some time to learn about the rule defaults
and some other management techniques.
First,
there are four default rule policies that you can use to
either count Azure policy or build your policy off of as a
base their connectivity over security,
balanced security over connectivity and maximum detection.
We saw a little bit of configuration from two of these in an earlier module.
Here's what each of them really means to us connectivity over security
provides rule states that favor performance over security,
it typically won't have many false positives.
The balanced policy is one that's recommended for initial deployments,
aiming to balance both the connectivity and security needs.
The security over connectivity policy focuses more on security
and include CVSs scores of eight and above.
And finally that maximum detection includes all of
the rules and the other policies.
Rule updates is one management task that can be so cumbersome
with the constantly changing security landscape.
You'll need to be able to have consistent updates to your snort rules.
This will enable you to detect new and emerging threats more quickly.
Keep in mind that you can automate the rule downloads to assist with this.
Several of the GUI integrations that we've discussed do this
for you or at least are configurable for it.
Besides the GUI tools,
you can create things like Cron jobs and other automation
techniques to download or replace rules and rule sets,
but think about how difficult it would be to manage rules
and rule sets using techniques like this,
you'll have various Cron jobs or automation scripts in the
environment that you need to maintain and track.
The alternative is those GUI tools or something like pulled pork intelligence.
And emerging threats are big things as well,
things like IP block lists and emerging threat rules can
provide mechanisms for adding these into the mix by
intelligence and emerging threats.
I'm talking more about automated intelligence downloads for new rules,
new IOPS being blocked and even new plugins or pre processors.
Now there's ways you can expand snort to be able to utilize
and in just actual threat intelligence.
But in this context we're talking about new rules for
those newly discovered attacks.
These all expands towards functionality and as we'll see in the coming demos,
you can manually or automatically download and apply them