Re: Using LightSPD rules when we have custom config

Dheeraj,

I check with some of our techincal experts on LightSPD and have the following feedback


  1.
 This is the correct understanding.  The best way to do custom changes, in a permanent and easily maintainable way is to create a custom policy file where the start of the file is : include("/path/to/stock/policy.lua") and then the tweaks and changes to that config are added afterward to layer on top the stock config.
  2.
Rule states are set by the last rule state read.  So what you can do is create a file that includes rule state lines of the form alert (gid:1; sid:39905; enable:no;)  (to turn rules on, you can either do enable:yes; or simply leave the enable directive off of the line) and then in your custom configuration file described above, add the line ips.states = ips.states .. "include /path/to/custom/rulestates.rules\n"
Please note,  since it's the last rule state that matters in this case, it's only if a previous rule states file turned a rule on. If yours is loaded last and turns it off, it'll be off.

  3.
Not at this time.

________________________________
From: Snort-users <[email protected]> on behalf of Dheeraj Gupta via Snort-users <[email protected]>
Sent: Wednesday, August 14, 2024 3:23 AM
To: [email protected] <[email protected]>
Subject: [Snort-users] Using LightSPD rules when we have custom config

Hi,

I have been trying to understand usage of LightSPD rules in order to switch to using them. I had earlier too posted on the same topic in this mailing-list ( https://seclists.org/snort/2024/q1/44 ).

My understanding now is that in order to use the LightSPD rules, we do the following:

- Find out our snort version (V1)
- Unzip the LightSPD tarball and open manifest.json. Then lookup the latest version entry <= V1
- Specify architectures -> YOUR_ARCH -> modules_path to --plugin-path switch in snort command
- Specify policies_path/POLICY_NAME.lua as value to -c switch in snort command line

However, we have some customized configuration in our environment (afpacket daq, perf_monitor, alert_json, home_net,  port spec etc) which we would like to reuse when updating rules.  What is the standard procedure when using LightSPD with custom configuration? I would not like to specify all configuration options in command line but use lua files for the same

- Do we define our own config file and keep an include() which is updated with appropriate policy based on LightSPD at every update? or can we use command line switches to specify base and custom policy files?
- How can we disable certain rules (in pulledpork we can update disablesid.conf) or enable or modify the rules when deploying rule updates? Would this be done in our lua config and can we use rule sids or gids directly to enable/disable?
- Is there a standard tool (something like pulledpork) which can automate extraction of paths from manifest?

Regards,
Dheeraj

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette