Re: Snort3 configuration issues

Yehor Velykozhon via Snort-users <[email protected]>
Newsgroups gmane.comp.security.ids.snort.general
Message-ID <[email protected]> 
As I can see, in ips section to variable you assign “default_variables_singletable”

From your snort.lua:
ips = {
    ……….,
    variables = default_variables_singletable
}

Did you change snort_defaults.lua also?
In order to use another name instead of “default_variables”, you need do the following:

  1.  Open in text editor /usr/local/etc/snort/snort_defaults.lua
  2.  Find “default_variables” or “default variables”
  3.  Change “default_variables” to a new name (according to your snort.lua – “default_variables_singletable”)

The other way – define all variable in the snort.lua, an example how doing it you can find in snort_defaults.lua, section “default variables”.

I attached your snort.lua in order not to lose it.

Thanks, Yehor.

From: Yehor Velykozhon <[email protected]>
Date: Wednesday, 1 December 2021 at 10:06
To: Francisco Godoy Gmail <[email protected]>
Cc: "'Shravan Rangarajuvenkata (shrarang)'" <[email protected]>, "[email protected]" <[email protected]>
Subject: Re: [Snort-users] Snort3 configuration issues

As I understand, you followed the steps from https://kifarunix.com/install-and-configure-snort-3-nids-on-ubuntu-20-04/

On the step “Under IPS section, define the location to your rules;”
You should add following configuration in ips section: “variables = default_variables”

If this didn’t help, can you execute the following command and send result of it?

Command: cat /usr/local/etc/snort/snort.lua

Thanks, Yehor.

From: Francisco Godoy Gmail <[email protected]>
Date: Wednesday, 24 November 2021 at 14:04
To: Yehor Velykozhon <[email protected]>
Cc: "'Shravan Rangarajuvenkata (shrarang)'" <[email protected]>, "[email protected]" <[email protected]>
Subject: RES: [Snort-users] Snort3 configuration issues


CAUTION: This email originated from outside the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe.
thank you very much 😊
Unfortunely, this “snort.lua” has the same configs than mine.
Could you please send a file with the adjusts ?

Sory about my poor skiks over snort ☹

Best regards
Francisco


De: Yehor Velykozhon <[email protected]>
Enviada em: quarta-feira, 24 de novembro de 2021 06:10
Para: Francisco Godoy Gmail <[email protected]>
Cc: 'Shravan Rangarajuvenkata (shrarang)' <[email protected]>; [email protected]
Assunto: Re: [Snort-users] Snort3 configuration issues

Here is the link to the GitHub repository of Snort3 where you can find all default configurations:
https://github.com/snort3/snort3/tree/master/lua

I attached snort.lua from that repository.

Thanks, Yehor.

From: Francisco Godoy Gmail <[email protected]<mailto:[email protected]>>
Date: Wednesday, 24 November 2021 at 10:39
To: Yehor Velykozhon <[email protected]<mailto:[email protected]>>
Cc: "'Shravan Rangarajuvenkata (shrarang)'" <[email protected]<mailto:[email protected]>>, "[email protected]<mailto:[email protected]>" <[email protected]<mailto:[email protected]>>
Subject: RES: [Snort-users] Snort3 configuration issues


CAUTION: This email originated from outside the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe.
Thank you again,
Do you have a snort.lua file and could you send it for me please ?


thank you very much 😊


De: Yehor Velykozhon <[email protected]<mailto:[email protected]>>
Enviada em: terça-feira, 23 de novembro de 2021 08:44
Para: Francisco Godoy Gmail <[email protected]<mailto:[email protected]>>
Cc: 'Shravan Rangarajuvenkata (shrarang)' <[email protected]<mailto:[email protected]>>; [email protected]<mailto:[email protected]>
Assunto: Re: [Snort-users] Snort3 configuration issues

You should add the following line in config file after including snort_defaults.lua

ips = { variables = default_variables }

Example:
-----------------------------------------------------------------------
HOME_NET = "10.10.10.0/24"
EXTERNAL_NET = '[10.0.17.0/24 10.0.14.0/24 192.168.0.0/16]'

conf_dir = os.getenv(‘LUA_PATH’)

if ( not conf_dir ) then
   conf_dir = '.'
end

dofile(conf_dir .. '/snort_defaults.lua')

ips = { variables = default_variables }
-----------------------------------------------------------------------

You should be aware of overriding ips module: ‘ips = { … }’ mean that all previous data in ips will be discarded.
If in your configuration you have previously defined ips module, instead of “ips = { variables = default_variables }”
write “ips.variables = default_variables”


Thanks, Yehor.

From: Francisco Godoy Gmail <[email protected]<mailto:[email protected]>>
Date: Sunday, 21 November 2021 at 11:20
To: Yehor Velykozhon <[email protected]<mailto:[email protected]>>
Cc: "'Shravan Rangarajuvenkata (shrarang)'" <[email protected]<mailto:[email protected]>>, "[email protected]<mailto:[email protected]>" <[email protected]<mailto:[email protected]>>
Subject: RES: [Snort-users] Snort3 configuration issues


CAUTION: This email originated from outside the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe.
Thank you, an apologize ☹ But does not worked, I am trying to use other rule base “snortrules-snapshot-31150”.
Attached the error founded.
More one time thank you a lot about your patience

Best Regards
Francisco

De: Yehor Velykozhon <[email protected]<mailto:[email protected]>>
Enviada em: segunda-feira, 8 de novembro de 2021 07:27
Para: [email protected]<mailto:[email protected]>
Cc: Shravan Rangarajuvenkata (shrarang) <[email protected]<mailto:[email protected]>>; [email protected]<mailto:[email protected]>
Assunto: Re: [Snort-users] Snort3 configuration issues

Hello Francisco!

All variables must be assigned before including snort_defaults.lua

Example of snort.lua:
-----------------------------------------------------------------------
HOME_NET = "10.10.10.0/24"
EXTERNAL_NET = '[10.0.17.0/24 10.0.14.0/24 192.168.0.0/16]'

conf_dir = os.getenv(‘LUA_PATH’)

if ( not conf_dir ) then
   conf_dir = '.'
end

dofile(conf_dir .. '/snort_defaults.lua')
-----------------------------------------------------------------------

or

-----------------------------------------------------------------------
ips =
{
   id = 1,
   rules = local_rules,
   variables =
   {
       nets =
       {
           HOME_NET = '192.168.1.0/24',
           EXTERNAL_NET = '10.10.10.0/24'
       }
   }
}
-----------------------------------------------------------------------

Thank you, Yehor!

From: Snort-users <[email protected]<mailto:[email protected]>> on behalf of "Shravan Rangarajuvenkata (shrarang) via Snort-users" <[email protected]<mailto:[email protected]>>
Reply to: "Shravan Rangarajuvenkata (shrarang)" <[email protected]<mailto:[email protected]>>
Date: Tuesday, 2 November 2021 at 18:11
To: "[email protected]<mailto:[email protected]>" <[email protected]<mailto:[email protected]>>
Cc: "[email protected]<mailto:[email protected]>" <[email protected]<mailto:[email protected]>>
Subject: [Snort-users] Snort3 configuration issues


CAUTION: This email originated from outside the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe.


From: Francisco Godoy Gmail <[email protected]<mailto:[email protected]>>
Date: Monday, November 1, 2021 at 10:59 AM
To: Shravan Rangarajuvenkata (shrarang) <[email protected]<mailto:[email protected]>>
Subject: RES: [Snort-openappid] RTMP packets have no "http://"
Hello Shravan
I am trying to install Snort 3 but I saw the error below:

Finished /usr/local/etc/snort/snort.lua:
Loading /usr/local/etc/rules/snort3-community-rules/snort3-community.rules:
ERROR: /usr/local/etc/rules/snort3-community-rules/snort3-community.rules:389 Undefined variable in the string: $SQL_SERVERS.
ERROR: /usr/local/etc/rules/snort3-community-rules/snort3-community.rules:389 undefined variable in the string: $EXTERNAL_NET.
ERROR: /usr/local/etc/rules/snort3-community-rules/snort3-community.rules:1777 Undefined variable in the string: $HOME_NET.
ERROR: /usr/local/etc/rules/snort3-community-rules/snort3-community.rules:1777 undefined variable in the string: $EXTERNAL_NET.
FATAL: /usr/local/etc/rules/snort3-community-rules/snort3-community.rules:1777 ***PortVar Lookup failed on '$HTTP_PORTS'.
Fatal Error, Quitting..

snort.lua configuration:

“-- HOME_NET and EXTERNAL_NET must be set now
-- setup the network addresses you are protecting
HOME_NET = '10.1.5.253/32'

-- set up the external network addresses.
-- (leave as "any" in most situations)

-- EXTERNAL_NET = 'any'
EXTERNAL_NET = '!$HOME_NET'”

Source step by step installation website:
https://kifarunix.com/install-and-configure-snort-3-nids-on-ubuntu-20-04/

Could you  help me ?

thank you very much 😊


De: Snort-openappid <[email protected]<mailto:[email protected]>> Em nome de Shravan Rangarajuvenkata (shrarang) via Snort-openappid
Enviada em: quinta-feira, 21 de outubro de 2021 12:52
Para: [email protected]<mailto:[email protected]>
Assunto: [Snort-openappid] RTMP packets have no "http://"

Date: Thu, 12 Aug 2021 16:25:42 +0800 (CST)
From: ?? <[email protected]<mailto:[email protected]>>
To: [email protected]<mailto:[email protected]>
Subject: [Snort-openappid] the rtmp packets have no "http://"
Message-ID: <[email protected]<mailto:[email protected]>>
Content-Type: text/plain; charset="gbk"

static int detector_add_rtmp_url(lua_State* L)
{
..................
 ud->get_odp_ctxt().get_http_matchers().insert_rtmp_url_pattern(pattern);

Why is it here   http ?    the rtmp packets like this :  StreamPlayer/..flashVer...WIN 9,0,47,0..swfUrl...file://..tcUrl..*rtmp://fc432.streamedia.info/Strea.mPlayer/..fpad....audioCodecs

have no http:// xxxxxxxxxx

..................
}

>>> Because RTMP has similar metadata as HTTP, AppId treats RTMP traffic like HTTP for detecting payload applications in it. However, AppId uses separate matchers for RTMP as can be seen in the code:



void HttpPatternMatchers::insert_rtmp_url_pattern(DetectorAppUrlPattern* pattern)

{

    rtmp_url_patterns.emplace_back(pattern);

}

We have a separate Lua detector API for registering RTMP patterns – addRTMPUrl. The patterns registered with this API will not interfere with the HTTP patterns.

This API also allows you to register a path pattern. For example, in odp/lua/payload_group_chivas.lua:
gRTMPPatternList = {
    --ESPN Video
    { 0, 0, 0, 2933, 0, "espn.go.com", "/", "http:", "", 2933},
    --Crackle Video
    { 0, 0, 0, 2955, 0, "crackle.com", "/", "http:", "", 2955},
}

You could replace “http:” with the path pattern you need.

Please let us know if appid detection doesn’t work for your RTMP app after doing the above.

Thanks,
Shravan

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette
Lua-Cat-Error[1].txt (text/plain, 18.1 KB) 
=~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2021.12.01 07:21:25 =~=~=~=~=~=~=~=~=~=~=~=
sudo su
[sudo] password for snort: 
]0;root@SNORT3: /home/snortroot@SNORT3:/home/snort# 
]0;root@SNORT3: /home/snortroot@SNORT3:/home/snort# 
]0;root@SNORT3: /home/snortroot@SNORT3:/home/snort# pwd
/home/snort
]0;root@SNORT3: /home/snortroot@SNORT3:/home/snort# ls -la
total 104
drwxr-xr-x 17 snort snort  4096 nov 11 09:07 .
drwxr-xr-x  3 root  root   4096 nov  1 07:15 ..
-rw-------  1 snort snort  4494 dez  1 07:20 .bash_history
-rw-r--r--  1 snort snort   220 nov  1 07:15 .bash_logout
-rw-r--r--  1 snort snort  3771 nov  1 07:15 .bashrc
drwx------ 14 snort snort  4096 nov 11 09:08 .cache
drwx------ 13 snort snort  4096 nov  3 08:00 .config
drwxr-xr-x  2 snort snort  4096 nov  1 08:01 Desktop
drwxr-xr-x  2 snort snort  4096 nov  1 08:01 Documents
drwxr-xr-x  2 snort snort  4096 nov  1 08:01 Downloads
drwx------  3 snort snort  4096 nov 15 08:07 .gnupg
drwxr-xr-x  3 snort snort  4096 nov  1 08:01 .local
drwx------  4 snort snort  4096 nov 11 09:07 .mozilla
drwxr-xr-x  2 snort snort  4096 nov  1 08:01 Music
drwxr-xr-x  2 snort snort  4096 nov  1 08:01 Pictures
-rw-r--r--  1 snort snort   807 nov  1 07:15 .profile
drwxr-xr-x  2 snort snort  4096 nov  1 08:01 Public
drwxr-xr-x  5 root  root   4096 nov  1 09:32 snort-source-files
drwx------  2 snort snort  4096 nov  1 08:15 .ssh
-rw-r--r--  1 snort snort     0 nov  1 08:19 .sudo_as_admin_successful
drwxr-xr-x  2 snort snort  4096 nov  1 08:01 Templates
drwxr-xr-x  2 snort snort  4096 nov  1 08:01 Videos
-rw-------  1 snort snort 12504 nov 10 06:13 .viminfo
]0;root@SNORT3: /home/snortroot@SNORT3:/home/snort# snort -c /usr/local/etc/snort/snort.lua
--------------------------------------------------
o")~   Snort++ 3.1.15.0
--------------------------------------------------
Loading /usr/local/etc/snort/snort.lua:
Loading snort_defaults.lua:
Finished snort_defaults.lua:
Loading file_magic.lua:
Finished file_magic.lua:
	ssh
	hosts
	host_cache
	pop
	so_proxy
	stream_tcp
	smtp
	gtp_inspect
	packets
	dce_http_proxy
	stream_icmp
	normalizer
	ips
ERROR: /usr/local/etc/snort/snort.lua: can't find ips.variables.RULE_PATH
ERROR: /usr/local/etc/snort/snort.lua: can't find ips.variables.HOME_NET
ERROR: /usr/local/etc/snort/snort.lua: can't find ips.variables.SMTP_SERVERS
ERROR: /usr/local/etc/snort/snort.lua: can't find ips.variables.HTTP_SERVERS
ERROR: /usr/local/etc/snort/snort.lua: can't find ips.variables.EXTERNAL_NET
ERROR: /usr/local/etc/snort/snort.lua: can't find ips.variables.FTP_PORTS
ERROR: /usr/local/etc/snort/snort.lua: can't find ips.variables.BLACK_LIST_PATH
ERROR: /usr/local/etc/snort/snort.lua: can't find ips.variables.SQL_SERVERS
ERROR: /usr/local/etc/snort/snort.lua: can't find ips.variables.SIP_SERVERS
ERROR: /usr/local/etc/snort/snort.lua: can't find ips.variables.FTP_SERVERS
ERROR: /usr/local/etc/snort/snort.lua: can't find ips.variables.WHITE_LIST_PATH
ERROR: /usr/local/etc/snort/snort.lua: can't find ips.variables.FILE_DATA_PORTS
ERROR: /usr/local/etc/snort/snort.lua: can't find ips.variables.DNS_SERVERS
ERROR: /usr/local/etc/snort/snort.lua: can't find ips.variables.MAIL_PORTS
ERROR: /usr/local/etc/snort/snort.lua: can't find ips.variables.SIP_PORTS
ERROR: /usr/local/etc/snort/snort.lua: can't find ips.variables.BUILTIN_RULE_PATH
ERROR: /usr/local/etc/snort/snort.lua: can't find ips.variables.ORACLE_PORTS
ERROR: /usr/local/etc/snort/snort.lua: can't find ips.variables.TELNET_SERVERS
ERROR: /usr/local/etc/snort/snort.lua: can't find ips.variables.SSH_PORTS
ERROR: /usr/local/etc/snort/snort.lua: can't find ips.variables.HTTP_PORTS
ERROR: /usr/local/etc/snort/snort.lua: can't find ips.variables.PLUGIN_RULE_PATH
ERROR: /usr/local/etc/snort/snort.lua: can't find ips.variables.SSH_SERVERS
	stream_udp
	binder
	wizard
	appid
	search_engine
	file_id
	ftp_data
	ftp_server
	port_scan
	dce_http_server
	dce_smb
	network
	dce_tcp
	telnet
	ssl
	sip
	rpc_decode
	netflow
	http_inspect
	http2_inspect
	modbus
	host_tracker
	stream_user
	stream_ip
	trace
	back_orifice
	classifications
	dnp3
	active
	ftp_client
	decode
	daq
	alerts
	stream
	references
	arp_spoof
	output
	process
	dns
	dce_udp
	imap
	stream_file
Finished /usr/local/etc/snort/snort.lua:
Loading ips.rules:
FATAL: ips.rules:3 undefined variable name: RULE_PATH.
Fatal Error, Quitting..
]0;root@SNORT3: /home/snortroot@SNORT3:/home/snort# 
]0;root@SNORT3: /home/snortroot@SNORT3:/home/snort# 
]0;root@SNORT3: /home/snortroot@SNORT3:/home/snort# 
]0;root@SNORT3: /home/snortroot@SNORT3:/home/snort# 
]0;root@SNORT3: /home/snortroot@SNORT3:/home/snort# 
]0;root@SNORT3: /home/snortroot@SNORT3:/home/snort# 
]0;root@SNORT3: /home/snortroot@SNORT3:/home/snort# 
]0;root@SNORT3: /home/snortroot@SNORT3:/home/snort# 
]0;root@SNORT3: /home/snortroot@SNORT3:/home/snort# 
]0;root@SNORT3: /home/snortroot@SNORT3:/home/snort# 
]0;root@SNORT3: /home/snortroot@SNORT3:/home/snort# 
]0;root@SNORT3: /home/snortroot@SNORT3:/home/snort# 
]0;root@SNORT3: /home/snortroot@SNORT3:/home/snort# 
]0;root@SNORT3: /home/snortroot@SNORT3:/home/snort# 
]0;root@SNORT3: /home/snortroot@SNORT3:/home/snort# 
]0;root@SNORT3: /home/snortroot@SNORT3:/home/snort# 
]0;root@SNORT3: /home/snortroot@SNORT3:/home/snort# 
]0;root@SNORT3: /home/snortroot@SNORT3:/home/snort# ###################################################################################3
]0;root@SNORT3: /home/snortroot@SNORT3:/home/snort# 
]0;root@SNORT3: /home/snortroot@SNORT3:/home/snort# 
]0;root@SNORT3: /home/snortroot@SNORT3:/home/snort# 
]0;root@SNORT3: /home/snortroot@SNORT3:/home/snort# 
]0;root@SNORT3: /home/snortroot@SNORT3:/home/snort# 
]0;root@SNORT3: /home/snortroot@SNORT3:/home/snort# 
]0;root@SNORT3: /home/snortroot@SNORT3:/home/snort# 
]0;root@SNORT3: /home/snortroot@SNORT3:/home/snort# 
]0;root@SNORT3: /home/snortroot@SNORT3:/home/snort# 
]0;root@SNORT3: /home/snortroot@SNORT3:/home/snort# 
]0;root@SNORT3: /home/snortroot@SNORT3:/home/snort# cat /usr/local/etc/snort/snort.lua
---------------------------------------------------------------------------
-- Snort++ configuration
---------------------------------------------------------------------------

-- there are over 200 modules available to tune your policy.
-- many can be used with defaults w/o any explicit configuration.
-- use this conf as a template for your specific configuration.

-- 1. configure defaults
-- 2. configure inspection
-- 3. configure bindings
-- 4. configure performance
-- 5. configure detection
-- 6. configure filters
-- 7. configure outputs
-- 8. configure tweaks

---------------------------------------------------------------------------
-- 1. configure defaults
---------------------------------------------------------------------------

-- HOME_NET and EXTERNAL_NET must be set now
-- setup the network addresses you are protecting
 HOME_NET = 'any'

-- set up the external network addresses.
-- (leave as "any" in most situations)
 EXTERNAL_NET = 'any'



include 'snort_defaults.lua'
include 'file_magic.lua'

---------------------------------------------------------------------------
-- 2. configure inspection
---------------------------------------------------------------------------

-- mod = { } uses internal defaults
-- you can see them with snort --help-module mod

-- mod = default_mod uses external defaults
-- you can see them in snort_defaults.lua

-- the following are quite capable with defaults:

stream = { }
stream_ip = { }
stream_icmp = { }
stream_tcp = { }
stream_udp = { }
stream_user = { }
stream_file = { }

arp_spoof = { }
back_orifice = { }
dnp3 = { }
dns = { }
http_inspect = { }
http2_inspect = { }
imap = { }
modbus = { }
netflow = {}
normalizer = { }
pop = { }
rpc_decode = { }
sip = { }
ssh = { }
ssl = { }
telnet = { }

dce_smb = { }
dce_tcp = { }
dce_udp = { }
dce_http_proxy = { }
dce_http_server = { }

-- see snort_defaults.lua for default_*
gtp_inspect = default_gtp
port_scan = default_med_port_scan
smtp = default_smtp

ftp_server = default_ftp_server
ftp_client = { }
ftp_data = { }

-- see file_magic.lua for file id rules
file_id = { file_rules = file_magic }

-- the following require additional configuration to be fully effective:

appid =
{
    -- appid requires this to use appids in rules
    --app_detector_dir = 'directory to load appid detectors from'
}

--[[
reputation =
{
    -- configure one or both of these, then uncomment reputation
    --blacklist = 'blacklist file name with ip lists'
    --whitelist = 'whitelist file name with ip lists'
}
--]]

---------------------------------------------------------------------------
-- 3. configure bindings
---------------------------------------------------------------------------

wizard = default_wizard

binder =
{
    -- port bindings required for protocols without wizard support
    { when = { proto = 'udp', ports = '53', role='server' },  use = { type = 'dns' } },
    { when = { proto = 'tcp', ports = '53', role='server' },  use = { type = 'dns' } },
    { when = { proto = 'tcp', ports = '111', role='server' }, use = { type = 'rpc_decode' } },
    { when = { proto = 'tcp', ports = '502', role='server' }, use = { type = 'modbus' } },
    { when = { proto = 'tcp', ports = '2123 2152 3386', role='server' }, use = { type = 'gtp_inspect' } },

    { when = { proto = 'tcp', service = 'dcerpc' }, use = { type = 'dce_tcp' } },
    { when = { proto = 'udp', service = 'dcerpc' }, use = { type = 'dce_udp' } },
    { when = { proto = 'udp', service = 'netflow' }, use = { type = 'netflow' } },

    { when = { service = 'netbios-ssn' },      use = { type = 'dce_smb' } },
    { when = { service = 'dce_http_server' },  use = { type = 'dce_http_server' } },
    { when = { service = 'dce_http_proxy' },   use = { type = 'dce_http_proxy' } },

    { when = { service = 'dnp3' },             use = { type = 'dnp3' } },
    { when = { service = 'dns' },              use = { type = 'dns' } },
    { when = { service = 'ftp' },              use = { type = 'ftp_server' } },
    { when = { service = 'ftp-data' },         use = { type = 'ftp_data' } },
    { when = { service = 'gtp' },              use = { type = 'gtp_inspect' } },
    { when = { service = 'imap' },             use = { type = 'imap' } },
    { when = { service = 'http' },             use = { type = 'http_inspect' } },
    { when = { service = 'http2' },            use = { type = 'http2_inspect' } },
    { when = { service = 'modbus' },           use = { type = 'modbus' } },
    { when = { service = 'pop3' },             use = { type = 'pop' } },
    { when = { service = 'ssh' },              use = { type = 'ssh' } },
    { when = { service = 'sip' },              use = { type = 'sip' } },
    { when = { service = 'smtp' },             use = { type = 'smtp' } },
    { when = { service = 'ssl' },              use = { type = 'ssl' } },
    { when = { service = 'sunrpc' },           use = { type = 'rpc_decode' } },
    { when = { service = 'telnet' },           use = { type = 'telnet' } },

    { use = { type = 'wizard' } }
}

---------------------------------------------------------------------------
-- 4. configure performance
---------------------------------------------------------------------------

-- use latency to monitor / enforce packet and rule thresholds
--latency = { }

-- use these to capture perf data for analysis and tuning
--profiler = { }
--perf_monitor = { }

---------------------------------------------------------------------------
-- 5. configure detection
---------------------------------------------------------------------------

references = default_references
classifications = default_classifications

ips =
{
    -- use this to enable decoder and inspector alerts
    --enable_builtin_rules = true,

    -- use include for rules files; be sure to set your path
    -- note that rules files can include other rules files
    --include = 'snort3-community.rules',

    -- RULE_PATH is typically set in snort_defaults.lua
    rules = [[

        include $RULE_PATH/snort3-app-detect.rules
        include $RULE_PATH/snort3-browser-chrome.rules
        include $RULE_PATH/snort3-browser-firefox.rules
        include $RULE_PATH/snort3-browser-ie.rules
        include $RULE_PATH/snort3-browser-other.rules
        include $RULE_PATH/snort3-browser-plugins.rules
        include $RULE_PATH/snort3-browser-webkit.rules
        include $RULE_PATH/snort3-content-replace.rules
        include $RULE_PATH/snort3-exploit-kit.rules
        include $RULE_PATH/snort3-file-executable.rules
        include $RULE_PATH/snort3-file-flash.rules
        include $RULE_PATH/snort3-file-identify.rules
        include $RULE_PATH/snort3-file-image.rules
        include $RULE_PATH/snort3-file-java.rules
        include $RULE_PATH/snort3-file-multimedia.rules
        include $RULE_PATH/snort3-file-office.rules
        include $RULE_PATH/snort3-file-other.rules
        include $RULE_PATH/snort3-file-pdf.rules
        include $RULE_PATH/snort3-indicator-compromise.rules
        include $RULE_PATH/snort3-indicator-obfuscation.rules
        include $RULE_PATH/snort3-indicator-scan.rules
        include $RULE_PATH/snort3-indicator-shellcode.rules
        include $RULE_PATH/snort3-malware-backdoor.rules
        include $RULE_PATH/snort3-malware-cnc.rules
        include $RULE_PATH/snort3-malware-other.rules
        include $RULE_PATH/snort3-malware-tools.rules
        include $RULE_PATH/snort3-netbios.rules
        include $RULE_PATH/snort3-os-linux.rules
        include $RULE_PATH/snort3-os-mobile.rules
        include $RULE_PATH/snort3-os-other.rules
        include $RULE_PATH/snort3-os-solaris.rules
        include $RULE_PATH/snort3-os-windows.rules
        include $RULE_PATH/snort3-policy-multimedia.rules
        include $RULE_PATH/snort3-policy-other.rules
        include $RULE_PATH/snort3-policy-social.rules
        include $RULE_PATH/snort3-policy-spam.rules
        include $RULE_PATH/snort3-protocol-dns.rules
        include $RULE_PATH/snort3-protocol-finger.rules
        include $RULE_PATH/snort3-protocol-ftp.rules
        include $RULE_PATH/snort3-protocol-icmp.rules
        include $RULE_PATH/snort3-protocol-imap.rules
        include $RULE_PATH/snort3-protocol-nntp.rules
        include $RULE_PATH/snort3-protocol-other.rules
        include $RULE_PATH/snort3-protocol-pop.rules
        include $RULE_PATH/snort3-protocol-rpc.rules
        include $RULE_PATH/snort3-protocol-scada.rules
        include $RULE_PATH/snort3-protocol-services.rules
        include $RULE_PATH/snort3-protocol-snmp.rules
        include $RULE_PATH/snort3-protocol-telnet.rules
        include $RULE_PATH/snort3-protocol-tftp.rules
        include $RULE_PATH/snort3-protocol-voip.rules
        include $RULE_PATH/snort3-pua-adware.rules
        include $RULE_PATH/snort3-pua-other.rules
        include $RULE_PATH/snort3-pua-p2p.rules
        include $RULE_PATH/snort3-pua-toolbars.rules
        include $RULE_PATH/snort3-server-apache.rules
        include $RULE_PATH/snort3-server-iis.rules
        include $RULE_PATH/snort3-server-mail.rules
        include $RULE_PATH/snort3-server-mssql.rules
        include $RULE_PATH/snort3-server-mysql.rules
        include $RULE_PATH/snort3-server-oracle.rules
        include $RULE_PATH/snort3-server-other.rules
        include $RULE_PATH/snort3-server-samba.rules
        include $RULE_PATH/snort3-server-webapp.rules
        include $RULE_PATH/snort3-sql.rules
        include $RULE_PATH/snort3-x11.rules

    ]],

    variables = default_variables_singletable
}

rewrite = { }

-- use these to configure additional rule actions
-- react = { }
-- reject = { }

-- use this to enable payload injection utility
-- payload_injector = { }

---------------------------------------------------------------------------
-- 6. configure filters
---------------------------------------------------------------------------

-- below are examples of filters
-- each table is a list of records

--[[
suppress =
{
    -- don't want to any of see these
    { gid = 1, sid = 1 },

    -- don't want to see these for a given server
    { gid = 1, sid = 2, track = 'by_dst', ip = '1.2.3.4' },
}
--]]

--[[
event_filter =
{
    -- reduce the number of events logged for some rules
    { gid = 1, sid = 1, type = 'limit', track = 'by_src', count = 2, seconds = 10 },
    { gid = 1, sid = 2, type = 'both',  track = 'by_dst', count = 5, seconds = 60 },
}
--]]

--[[
rate_filter =
{
    -- alert on connection attempts from clients in SOME_NET
    { gid = 135, sid = 1, track = 'by_src', count = 5, seconds = 1,
      new_action = 'alert', timeout = 4, apply_to = '[$SOME_NET]' },

    -- alert on connections to servers over threshold
    { gid = 135, sid = 2, track = 'by_dst', count = 29, seconds = 3,
      new_action = 'alert', timeout = 1 },
}
--]]

---------------------------------------------------------------------------
-- 7. configure outputs
---------------------------------------------------------------------------

-- event logging
-- you can enable with defaults from the command line with -A <alert_type>
-- uncomment below to set non-default configs
--alert_csv = { }
--alert_fast = { }
--alert_full = { }
--alert_sfsocket = { }
--alert_syslog = { }
--unified2 = { }

-- packet logging
-- you can enable with defaults from the command line with -L <log_type>
--log_codecs = { }
--log_hext = { }
--log_pcap = { }

-- additional logs
--packet_capture = { }
--file_log = { }

---------------------------------------------------------------------------
-- 8. configure tweaks
---------------------------------------------------------------------------

if ( tweaks ~= nil ) then
    include(tweaks .. '.lua')
end

]0;root@SNORT3: /home/snortroot@SNORT3:/home/snort#
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.