Intrusion detection with Snort
Writing rules, reading alerts and tuning them.
Level 301 · 15 lessons · 12 practice labs
Lessons
Getting to know Snort
- Snort and intrusion detection (IDS) concepts: You will understand what an intrusion detection system (IDS) such as Snort does, the difference between signature and anomaly detection, and where it sits in a network.
- Snort configuration and HOME_NET: You learn what basic settings such as HOME_NET do in Snort's configuration and how to set them for your own network.
- Snort sniffer and packet-logger modes: You learn to run Snort in your own lab in sniffer mode, which only shows packets, and in packet-logger mode, which records them.
- Snort 3 configuration: snort.lua and inspectors
- Short task: run Snort on a PCAP and report the alert count
Writing rules
- Snort rule anatomy: header and options: You learn to read the header and option parts of a Snort rule and work out what the rule was written to catch.
- Writing local rules with Snort: You learn to write a simple local Snort rule to watch for a behaviour on your own network and confirm that it raises an alert.
- Content matching and PCRE in Snort: You will learn to match packet content in Snort rules with text and regular expressions (PCRE) and see how specific a rule must be to cut false alarms.
- Testing a rule with recorded traffic: true and false samples
- Short task: write a rule that catches requests to the lab app’s admin panel
Detection and tuning
- Detecting web attack patterns with Snort: You learn about Snort rules that detect known attack patterns aimed at your own lab web server and what the resulting alerts look like.
- Detecting scan activity with Snort: You learn to set up Snort rules that notice reconnaissance such as port scanning on your network and to follow the alerts.
- Reading and interpreting Snort alerts: You learn to read Snort alerts and use priority, source and destination details to tell a real problem from a false alarm.
- Thresholds, suppression and cutting noise in Snort
- Capstone: an incident report from Snort alerts: You go through a fictional company's Snort alerts and write a short incident report that explains what happened and gives recommendations.
Practice labs
- Run Snort on a PCAP: Pass a prepared capture through Snort and report the number of alerts produced.
- Define HOME_NET correctly: Write the lab network's address range into the configuration and show how the alerts change on the same capture.
- Tune the inspectors in snort.lua: Teach the Snort 3 HTTP inspector a non-standard port and pass the configuration test.
- Split a rule header into its parts: Explain the action, protocol, address, port and direction parts of three ready-made rules.
- A rule catching the admin panel request: Write a local rule catching requests to the lab app's admin panel with content matching and test it against a capture.
- A rule narrowed with PCRE: Add PCRE to a content match so the rule fires only on requests carrying a numeric id and prove it with true and false sample captures.
- Detect the trace of a scan: Pass a scan capture taken on the lab network through Snort and show which rule fired.
- Catch web attack patterns: Write two rules catching directory traversal and injection attempts in a capture of your own lab web app.
- Compare two rules on the same event: Compare the alert counts and misses of a broad and a narrow rule on the same scan capture.
- Read an alert line: Write the signature id, priority, class and endpoints of five alerts into a table.
- Reduce noise with a threshold: Add a threshold to a rule firing hundreds of times a minute and measure the drop in alerts.
- An incident report from alerts: Put the Snort alerts of the Göktaşı Yazılım lab network in time order and write a one-page report telling what happened.
About this course
Writing rules, reading alerts and tuning them.
What you will learn
- Getting to know Snort
- Writing rules
- Detection and tuning
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.