在Snort警报文件中指定规则地址

Question

I am working on a project, which deals with changing the order of the rules, to make the IDS process faster and more efficient. I just have to find where the rule generating any alert in snort alert file, is located. (I mean the rule is located on which line, in which rule file?) Can anyone help me find out?

Answer 1

To locate rules within the configuration file:

you can use signature ID of snort rules.

For example,

[**] [1:5000361:0] need-to-know - suspicious spammed domain [**]

here the signature ID is 5000361 .

or, you can search in the configuration file for the referenece shown in the alert

[Xref => url www.spamhaus.org/query/dbl?domain=xxxxxxx.com]

In the above line, the reference is www.spamhaus.org/query/dbl?domain=xxxxxxx.com

Snort configuration file is specified using the -c option followed by the name of the configuration file, usually named as snort.conf . Since it is specified using the option, it could be located anywhere on the system. Usually it can be found at /usr/local/etc/snort.conf or in the directory where snort is installed.

Answer 2

This question doesn't really make any sense. "I am working on a project, which deals with changing the order of the rules, to make the IDS process faster and more efficient."

This implies that if you change the order that the snort rules are in in a file then it will change the order in which they are evaluated, and that is completely wrong. The way snort works in terms of rule evaluation is much more complicated and to be more efficient you must make your rules more efficient. For snort the most important part of a rule is the fast_pattern keyword. Even if you do not specify a fast_pattern in a rule snort will automatically choose the longest content match in the rule that is at least 3 characters and use this as the fast_pattern. For every packet that comes in snort will build a rule evaluation tree for that packet and the order of these rules is completely unrelated to the order that they are stored in the config files. Snort will just read all rules in the configs and the order they are evaluated is determined when it receives the packet at during run time.