[Day 2] 3. SNORT Rules

Writing a SNORT Rule

• To create a rule, start with an empty text file and write the rule in it.
• Each rule is separated by a space.
• This file must be saved with a
  Copy

  .rules

  extension.

---

Basic Rule Syntax

Example:

plaintextCopy
alert ip any any -> any any (msg: "Any alert message"; sid: 1000001;)

Explanation of Components:

1. alert: Specifies the action to take (in this case, to generate an alert).
2. ip: Protocol to monitor (here, IP protocol).
3. any any -> any any:
   • Copy

     source IP

     ,
     Copy

     source port

     ->
     Copy

     direction

     ->
     Copy

     destination IP

     ,
     Copy

     destination port

     .
   • Copy

     any

     : Refers to any IP address or port.
4. (msg: "Any alert message"): Custom message to display when the rule is triggered.
5. sid: A unique identifier for the rule.
   • Copy

     sid

     stands for "SNORT ID".
   • This helps SNORT differentiate between multiple rules.

---

What This Rule Does

This particular rule generates an alert for:

• Traffic from any source IP and port,
• To any destination IP and port,
• Displaying the message: "Any alert message".

---

Saving the Rule

• Save this file in the
  Copy

  rules

  folder inside the
  Copy

  Snort

  directory.
• Use any name you prefer, but the file must have the
  Copy

  .rules

  extension.
  Example:

plaintextCopy
anything.rules

---

Linking the Rule in the Configuration

1. Open the

   Copy

   snort.conf

   file.

2. Add the following line to include your custom rule file:

   plaintextCopy
   include $RULE_PATH/anything.rules
   

3. Save the configuration file.

---

Testing the Rule

Run the following command to validate your new rule file:

shellCopy
snort -i 4 -c c:\Snort\etc\snort.conf -l c:\Snort\log -T

Explanation of the Command:

• Copy

  -i 4

  : Specifies the interface number.
• Copy

  -c c:\Snort\etc\snort.conf

  : Path to the SNORT configuration file.
• Copy

  -l c:\Snort\log

  : Path to the log folder.
• Copy

  -T

  : Testing mode to validate the configuration.

---

Successful Validation

If the output states "Successfully validated", your rule file is correctly configured and ready for use.

---