Re: Problem about snort3 so rules installation
"Adrian Mamolea \(admamole\) via Snort-users" <[email protected]>
| Newsgroups | gmane.comp.security.ids.snort.general |
|---|---|
| Message-ID | <SN6PR11MB322994411EBA53FDDA105113C2059@SN6PR11MB3229.namprd11.prod.outlook.com> |
Hello [email protected]<mailto:[email protected]>, SO ("shared object") rules are similar to Talos text rules but they contain custom detection logic implemented in C++. They are loaded when Snort starts from dynamic libraries, which typically have a .so extension on Linux. There are several steps to get an SO rule working properly. Checkout the example in the snort3_demo repo on github. The test.bats shows all the steps you need to implement your own: generate the include, compile, link the so, dump the stub, and then run using stub and so. Hope that helps. https://github.com/snort3/snort3_demo/tree/master/tests/ips_options/so_and_soid Thanks, Adrian From: Snort-users <[email protected]> On Behalf Of learning deep via Snort-users Sent: Saturday, November 12, 2022 6:21 AM To: [email protected] Subject: [Snort-users] Problem about snort3 so rules installation I have download snortrules-snapshot-31440 from snort.org<http://snort.org>. But I don't know how to use so rules in it. Can someone know it and help me? _______________________________________________ Snort-users mailing list [email protected] Go to this URL to change user options or unsubscribe: https://lists.snort.org/mailman/listinfo/snort-users To unsubscribe, send an email to: [email protected] Please visit http://blog.snort.org to stay current on all the latest Snort news! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette