Snort Rules and SA/NetWitness

[Anonymous]

Hello

where can i find a document that describe how to impliment Snort Rules in SA/NW? i know that is possible but i cant seem to find a document to describe the process.

[Anonymous]

https://sadocs.emc.com/0_en-us/098_10.3_SP1_User_Guide

You are likely looking for an App rule on the packet decoder.

[Anonymous]

I'd like to see a document on parsers and such.

mainly because im looking for a way to exctact more data from crash reports that SA see's.

[Anonymous]

I believe the directions for implementing snort rules existed on the 9.8 administration guide.  I'll have to check if it is on the docs site.

Basically, what I did was add a snort folder to /etc/netwitness/ng.  In that snort folder, I had a rules folder and a basic snort.conf file that pointed to the rules folder.  Inside the rules folder, I kept my snort rules, which I grabbed from emerging threats.  Then, I made sure the snort parser was enabled and restarted services.

[Anonymous]

ive noticed that alot of the better material from the 9x documentation has yet to make it in to the 10.3x docs or any of the Sa docs.

[Anonymous]

There is always room for improvement.

[Anonymous]

Do you have an example of what the Snort Config file would look like and is there any special format for the snort rules?

[RSAAdmin]

Here is an old doc I had on my laptop.  As noted above, if there is an NG directory, the snort subdirectory goes there.  I think the rest of the config is the same.  Also, this will register meta into the Feed Name, Feed Cat and Feed Desc keys, so if you hope to open these keys quickly, you should set indexing to IndexValues on the concentrators and brokers.

[RSAAdmin]

Whoops, it populates into threat.source, threat cat and threat desc.

[Anonymous · Accepted solution]

This might be what you are looking for.  Basically a vanilla snort.conf file and a rules folder with an emerging threats file in there.