[Autogenerated] now that we have the tool installed.
Let's go back into the lab and show the usage of
pulled pork to modify the rule sets, let's hop in.
Alright and welcome back to the lab in this last one,
we just went over how we can use pulled pork to automatically download and
modify the rule sets that we're actually using in snore.
Now we're gonna go back into the pulled pork configuration
file and see how we can modify those or change them around
and what the impacts of that is.
So let's first start out by navigating to the snort website and
let's talk about rule subscriptions first.
Now there's a couple different ways you can
download the rule sets that snort has,
there's a community rule set that's free for all users.
These are basic rules that will help get you set up and
your storage system up and running.
They're free to download and use but it doesn't have
everything that snort provides, especially the subscribers.
Now you can register for anoint code which you saw me put in to
my configuration file in the previous demo,
registered users under the free tier,
receive all of the typical snort subscriber rule set rules however,
they receive them on a delayed basis.
It's 30 days after the subscribers.
So if you care about having your rules updated in real time,
then a subscription could be beneficial for you.
There's a couple different tiers of subscription for snort.
If you are going to go ahead and go that route and
get those updates in real time.
There's a personal subscription.
There's a business one and then there's an integrator one as well.
Now one thing that's really cool is that not only can you use a
tool like pulled pork to download the rule sets,
but you can also go check them out on the snort.
website of course you have to log in so you can actually
see the tier that you're supposed to see.
So if I was signed in right now we would see the registered to your light up
as well which let me go ahead and sign in and show you.
And if I go back to downloads and the rules,
you see how the registered tier is available for me now.
So these come into tar dot GZ file and you can just go ahead and download
them and then you can unzip them and view the rules.
You can also look at the latest talus advisories as well straight from here,
so that's really cool that we can go here and check this stuff out
now with pulled pork to update these rule sets,
all we have to do is edit that configuration file,
we can go ahead and change for example are registered one back to false and
download the community rule set instead and we can also go ahead and add on
the emerging threats Block list and here too.
If you wanted to add additional block list,
you can by modifying this block list URL block once you
change your configuration around,
just go ahead and save it and then you can rerun the pulled pork process.
Now you can also set this to run on a Cron job,
you know on a daily or nightly basis to help out with that.
And then if we go ahead and look at the block list again,
we could see after we scrolled down that we have are emerging
threats blacklist now that was added or appended to the end
of the block list that we had.
That's because the other block list was still enabled.
Let's go ahead and disable that one.
Just the regular snort block list and see how the behavior is.
We'll run the command again and as you can see only the
emerging threat block list is here.
So pulled pork essentially overrides those files or updates
them so that only what you have in the configuration file is
downloaded and applied to snort.
So the blacklist files and the rules files are all
updated after you rerun pulled pork.
Once you change those configuration files,
so this is super easy to use to manage your rules.
And if you're only using snort in the cli you can go in and edit
the rules themselves if you want to as well.
But keep in mind that pulled pork will override them.
Next time you run the command