Re: SnortML
Yehor Velykozhon via Snort-users <[email protected]> Mon, 3 Feb 2025 10:44:20 +0000
| Newsgroups | gmane.comp.security.ids.snort.general |
|---|---|
| Message-ID | <AS2PR05MB10104BCA46B595D1E1D78685CBCF52@AS2PR05MB10104.eurprd05.prod.outlook.com> |
--===============8110610278932004861== Content-Language: en-GB Content-Type: multipart/alternative; boundary="_000_AS2PR05MB10104BCA46B595D1E1D78685CBCF52AS2PR05MB10104eu_" --_000_AS2PR05MB10104BCA46B595D1E1D78685CBCF52AS2PR05MB10104eu_ Content-Type: text/plain; charset="windows-1256" Content-Transfer-Encoding: quoted-printable Hello, there=92re different sources that you can use to get a better understanding= of SnortML module. As basic steps, you can check: 1. Details about SnortML module in snort3 repository: https://github.com= /snort3/snort3/blob/master/src/network_inspectors/kaizen/dev_notes.txt 2. Mandatory (to use SnortML) library: https://github.com/snort3/libml/t= ree/master Beside those, there is a blog posted by Brandon Stultz with deep dive into = SnortML: https://blog.snort.org/2024/03/talos-launching-new-machine-learnin= g.html Thanks, Yehor. From: Snort-users <[email protected]> on behalf of =D3=CC= =C7=CF =C7=E1=DD=C7=D1=D3 via Snort-users <[email protected]> Date: Friday, 31 January 2025 at 15:14 To: [email protected] <[email protected]> Subject: [Snort-users] SnortML CAUTION: This email originated from outside the organization. Do not click = links or open attachments unless you recognize the sender and know the cont= ent is safe. Hi all Can any one help me about SnortML Hiw can setup with snort3 --_000_AS2PR05MB10104BCA46B595D1E1D78685CBCF52AS2PR05MB10104eu_ Content-Type: text/html; charset="windows-1256" Content-Transfer-Encoding: quoted-printable <html xmlns:o=3D"urn:schemas-microsoft-com:office:office" xmlns:w=3D"urn:sc= hemas-microsoft-com:office:word" xmlns:m=3D"http://schemas.microsoft.com/of= fice/2004/12/omml" xmlns=3D"http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dwindows-1= 256"> <meta name=3D"Generator" content=3D"Microsoft Word 15 (filtered medium)"> <style><!-- /* Font Definitions */ @font-face {font-family:"Cambria Math"; panose-1:2 4 5 3 5 4 6 3 2 4;} @font-face {font-family:Calibri; panose-1:2 15 5 2 2 2 4 3 2 4;} @font-face {font-family:Aptos; panose-1:2 11 0 4 2 2 2 2 2 4;} /* Style Definitions */ p.MsoNormal, li.MsoNormal, div.MsoNormal {margin:0cm; font-size:12.0pt; font-family:"Aptos",sans-serif;} a:link, span.MsoHyperlink {mso-style-priority:99; color:#0563C1; text-decoration:underline;} p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph {mso-style-priority:34; margin-top:0cm; margin-right:0cm; margin-bottom:0cm; margin-left:36.0pt; font-size:12.0pt; font-family:"Aptos",sans-serif;} span.EmailStyle19 {mso-style-type:personal-reply; font-family:"Calibri",sans-serif; color:windowtext;} .MsoChpDefault {mso-style-type:export-only; font-size:10.0pt; mso-ligatures:none;} @page WordSection1 {size:612.0pt 792.0pt; margin:72.0pt 72.0pt 72.0pt 72.0pt;} div.WordSection1 {page:WordSection1;} /* List Definitions */ @list l0 {mso-list-id:268392275; mso-list-type:hybrid; mso-list-template-ids:1314836774 134807567 134807577 134807579 134807567 1= 34807577 134807579 134807567 134807577 134807579;} @list l0:level1 {mso-level-tab-stop:none; mso-level-number-position:left; text-indent:-18.0pt;} @list l0:level2 {mso-level-number-format:alpha-lower; mso-level-tab-stop:none; mso-level-number-position:left; text-indent:-18.0pt;} @list l0:level3 {mso-level-number-format:roman-lower; mso-level-tab-stop:none; mso-level-number-position:right; text-indent:-9.0pt;} @list l0:level4 {mso-level-tab-stop:none; mso-level-number-position:left; text-indent:-18.0pt;} @list l0:level5 {mso-level-number-format:alpha-lower; mso-level-tab-stop:none; mso-level-number-position:left; text-indent:-18.0pt;} @list l0:level6 {mso-level-number-format:roman-lower; mso-level-tab-stop:none; mso-level-number-position:right; text-indent:-9.0pt;} @list l0:level7 {mso-level-tab-stop:none; mso-level-number-position:left; text-indent:-18.0pt;} @list l0:level8 {mso-level-number-format:alpha-lower; mso-level-tab-stop:none; mso-level-number-position:left; text-indent:-18.0pt;} @list l0:level9 {mso-level-number-format:roman-lower; mso-level-tab-stop:none; mso-level-number-position:right; text-indent:-9.0pt;} ol {margin-bottom:0cm;} ul {margin-bottom:0cm;} --></style> </head> <body lang=3D"en-UA" link=3D"#0563C1" vlink=3D"#954F72" style=3D"word-wrap:= break-word"> <div class=3D"WordSection1"> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:11.0pt;font-= family:"Calibri",sans-serif;mso-fareast-language:EN-US">Hello,<o:= p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:11.0pt;font-= family:"Calibri",sans-serif;mso-fareast-language:EN-US"><o:p>&nbs= p;</o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:11.0pt;font-= family:"Calibri",sans-serif;mso-fareast-language:EN-US">there=92r= e different sources that you can use to get a better understanding of Snort= ML module.<o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:11.0pt;font-= family:"Calibri",sans-serif;mso-fareast-language:EN-US"><o:p>&nbs= p;</o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:11.0pt;font-= family:"Calibri",sans-serif;mso-fareast-language:EN-US">As basic = steps, you can check:<o:p></o:p></span></p> <ol style=3D"margin-top:0cm" start=3D"1" type=3D"1"> <li class=3D"MsoListParagraph" style=3D"margin-left:0cm;mso-list:l0 level1 = lfo1"><span lang=3D"EN-US" style=3D"font-size:11.0pt;font-family:"Cali= bri",sans-serif;mso-fareast-language:EN-US">Details about SnortML modu= le in snort3 repository: <a href=3D"https://github.com/snort3/snort3/blob/master/src/network_inspect= ors/kaizen/dev_notes.txt"> https://github.com/snort3/snort3/blob/master/src/network_inspectors/kaizen/= dev_notes.txt</a><o:p></o:p></span></li><li class=3D"MsoListParagraph" styl= e=3D"margin-left:0cm;mso-list:l0 level1 lfo1"><span lang=3D"EN-US" style=3D= "font-size:11.0pt;font-family:"Calibri",sans-serif;mso-fareast-la= nguage:EN-US">Mandatory (to use SnortML) library: <a href=3D"https://github.com/snort3/libml/tree/master">https://github.com/= snort3/libml/tree/master</a><o:p></o:p></span></li></ol> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:11.0pt;font-= family:"Calibri",sans-serif;mso-fareast-language:EN-US"><o:p></o:= p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:11.0pt;font-= family:"Calibri",sans-serif;mso-fareast-language:EN-US">Beside th= ose, there is a blog posted by Brandon Stultz with deep dive into SnortML: <a href=3D"https://blog.snort.org/2024/03/talos-launching-new-machine-learn= ing.html"> https://blog.snort.org/2024/03/talos-launching-new-machine-learning.html</a= ><o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:11.0pt;font-= family:"Calibri",sans-serif;mso-fareast-language:EN-US"><o:p>&nbs= p;</o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:11.0pt;font-= family:"Calibri",sans-serif;mso-fareast-language:EN-US"><o:p>&nbs= p;</o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:11.0pt;font-= family:"Calibri",sans-serif;mso-fareast-language:EN-US">Thanks, Y= ehor.<o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:11.0pt;font-= family:"Calibri",sans-serif;mso-fareast-language:EN-US"><o:p>&nbs= p;</o:p></span></p> <div id=3D"mail-editor-reference-message-container"> <div> <div> <div style=3D"border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm = 0cm 0cm"> <p class=3D"MsoNormal" style=3D"margin-bottom:12.0pt"><b><span style=3D"col= or:black">From: </span></b><span style=3D"color:black">Snort-users <snort-users-bounces@= lists.snort.org> on behalf of </span><span style=3D"font-family:"Arial",sans-serif;color:black"= >=D3=CC=C7=CF</span><span style=3D"color:black"> </span><span style=3D"font-family:"Arial",sans-serif;color:black"= >=C7=E1=DD=C7=D1=D3</span><span style=3D"color:black"> via Snort-users <= [email protected]><br> <b>Date: </b>Friday, 31 January 2025 at 15:14<br> <b>To: </b>[email protected] <[email protected]><= br> <b>Subject: </b>[Snort-users] SnortML<o:p></o:p></span></p> </div> <table class=3D"MsoNormalTable" border=3D"0" cellspacing=3D"0" cellpadding= =3D"0" align=3D"left"> <tbody> <tr> <td style=3D"background:#BBA555;padding:5.25pt 5.5pt 5.25pt 1.5pt"></td> <td width=3D"100%" style=3D"width:100.0%;background:#FFE599;padding:5.25pt = 3.75pt 5.25pt 11.25pt"> <div> <p style=3D"mso-element:frame;mso-element-frame-hspace:2.25pt;mso-element-w= rap:around;mso-element-anchor-vertical:paragraph;mso-element-anchor-horizon= tal:column;mso-height-rule:exactly"> <b><span style=3D"font-size:11.0pt;font-family:"Arial",sans-serif= ;color:#212121">CAUTION:</span></b><span style=3D"font-size:11.0pt;font-fam= ily:"Arial",sans-serif;color:#212121"> This email originated from= outside the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe. </span><o:p>= </o:p></p> </div> </td> </tr> </tbody> </table> <div> <p class=3D"MsoNormal">Hi all <o:p></o:p></p> <div> <p class=3D"MsoNormal">Can any one help me about SnortML<o:p></o:p></p> </div> <div> <p class=3D"MsoNormal">Hiw can setup with snort3<o:p></o:p></p> </div> </div> </div> </div> </div> </div> </body> </html> --_000_AS2PR05MB10104BCA46B595D1E1D78685CBCF52AS2PR05MB10104eu_-- --===============8110610278932004861== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Snort-users mailing list [email protected] Go to this URL to change user options or unsubscribe: https://lists.snort.org/mailman/listinfo/snort-users To unsubscribe, send an email to: [email protected] Please visit http://blog.snort.org to stay current on all the latest Snort news! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette --===============8110610278932004861==--