Snort Rules and SA/NetWitness

[Anonymous]

Hello

where can i find a document that describe how to impliment Snort Rules in SA/NW? i know that is possible but i cant seem to find a document to describe the process.

[Anonymous]

These instructions say to leave HOME_NET and EXTERNAL_NET as any.  Is this required?  I would like to make HOME_NET [10.0.0.0/8] and EXTERNAL_NET !$HOME_NET

[Anonymous]

If I mess this up what are the possible side effects?

[Anonymous]

my config is left as any.  Like I said, a vanilla conf file.  The snort parser is just parsing the content of the rules....there isn't a full blown snort engine on the decoder.

[Anonymous]

possible side effects include headaches, drowzyness, blurred vision, and warts.  J/K

Only side effect that I encountered, which wasn't really a side effect, was that I didn't get any meta generated.  I started with some emerging threats rules that I knew would fire.

[Anonymous]

OK I am running Netwitness 9.8.5.1 and etc/netwitness/ng/snort does not appear to be right as my logs don't show the anything saying anything about snort.  Any suggestions?

[Anonymous]

was the snort parser enabled?

Was the service restarted?

[Anonymous]

i followed the document and created a demo.rule file with the follwing rule

alert tcp any any -> $EXTERNAL_NET 80 (msg: "Hello Im Your New SNORT Rule"; reference: url,http://www.snort.org/snort-rules/; content: "snort"; flow:to_server; nocase; sid:9000547; rev:1)

when i reloaded the parsers i get this line in the log Snort info Loaded 0 snort rules, 0 small tokens, 0 with pcres, 0 partial

does anyone know why?

[Anonymous]

OK I restarted the decoder but I didn't see any documentation on how to enable the snort parser.  I just assumed it was just waiting for the snort config.

[RSAAdmin]

So for your version you want to make a snort directory under /etc/netwitness/parsers

[Anonymous]

Ok that helped some what.  I moved the snort directory to etc/netwitness/ng/parsers/snort.  When I run the reload parsers command i at least now get the same thing adimenia is getting, which is "Snort Info Loaded 0 snort rules, 0 small tokens, 0 with pcre, 0 partial"

So what are we missing.