SNORT rules for office network scenario

Robert Muscat
Robert Muscat used Ask the Experts™
on
Hi,

I am looking for some test cases I can include in a virtual network to create rules that can make sense in an office scenario, like prohibiting social media, proxies, etc. Any ideas are appreciated, so that I will apply rules according to a particular test case. Any difficulty level, and the more original they are, the better!

Thanks in advance
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Daryl BamforthTechnical Expert
Commented:
Your best bet is to go through the rule-sets available on SNORTs web site. They have a whole range of rules that have been built up overtime that are free to use. You can also opt to subscribe to get them 30days quicker than normal, registered users (essential for 0 day vulnerabilities). The list of their rule-set explanations are here

https://www.snort.org/rules_explanation

Which includes a nice short description so you can search for strings of interest to you (such as 'social media').

Author

Commented:
I actually require scenarios which default SNORT rules don't capture. Custom scenarios where I can craft rules for these custom scenarios hopefully.
Technical Expert
Commented:
Realistically the only way to get a good set of custom rules is to look at exactly what you need to achieve ... and then writing it yourself, for your scenario. Anyone that has created rules not provided by snort are not likely to share them as they will be bespoke to their scenario. Creating rules is not an overtly difficult task .. if you know or can identify exactly what it is you want to achieve .. and there a number of good guides online. I have listed a couple here.

The full section on writing snort rules is here, it has a number of examples throughout.
http://manual-snort-org.s3-website-us-east-1.amazonaws.com/node27.html

This takes you through building a rule.
http://archive.oreilly.com/pub/h/1393
Daryl BamforthTechnical Expert

Commented:
Instructions on creating custom rules.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial