Re: Cisco SO Rule Issue

Hello!

The issue is you haven't loaded the file type definitions.  The issue isn't specific to the SO rules; you should probably also see an issue in the plaintext rules.  This is what I get when I undefine the file_id module --

```
ERROR: snort3-file-java.rules:245 invalid argument file_type: = JAR
ERROR: snort3-file-java.rules:246 invalid argument file_type: = JAR
ERROR: file-office.rules:133 invalid argument file_type: = MSOLE2
ERROR: file-office.rules:163 invalid argument file_type: = MSOLE2
ERROR: file-pdf.rules:5 invalid argument file_type: = PDF
ERROR: file-pdf.rules:22 invalid argument file_type: = PDF
```

For snort 3.1.58.0, the configuration is file_id.rules_file, which is a separate file type definitions file that uses the much more capable and feature-rich snort rules language to identify file magic as opposed to earlier versions of snort which used a lua table of hex definitions defined with file_id.file_rules (yes, I realize the names are unfortunately similar, but "rules_file" made sense as the new name).  All of this is handled automatically by the lightSPD package available on snort.org.  Unfortunately, I just identified that this file is not included in the "old style" rules package that is the simple tarball of rules and configurations, but I'm working with the build team to get that taken care of in the next few releases.

If you want a temporary workaround, you could simply comment out or remove the specific rules that are complaining and then once the new package came out you could use the file_magic.rules file.  Or you could download the lightSPD package from snort.org and grab the file from there and update your configuration to point to it.  Or even better, you could use the lightSPD package directly since it's intrinsically designed to support all versions of snort 3 so you don't have to worry about things like this.  🙂

Good luck, and let me know how it goes.


Thanks,

~Patrick


________________________________
From: Snort-users <[email protected]> on behalf of Nick Godwod via Snort-users <[email protected]>
Sent: Friday, May 3, 2024 2:53 PM
To: [email protected] <[email protected]>
Subject: [Snort-users] Cisco SO Rule Issue

Folks,

Using Snort 3.1.58.0.
Pulledpork .8.0 Pulled the SO rules down for snort3, using the inline --plugin-path for SO rules.

You can see what the issue is "file_type" = PDF" or "MSOLE2" for SO rules.

I have no way of fixing these as the file type is from the .so files, no the rule match.


what is the best way forward from here? I need to use SO rules to comply with gov regs.
F

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette