Showing posts with label docs. Show all posts
Showing posts with label docs. Show all posts

Friday, October 11, 2019

Snort document updates

A couple updates to SNORTⓇ installation guides for Snort 3 have hit our documentation page, and we want to take a minute and personally thank the community members that spend their time writing documentation, quality checking it, testing it, and putting it out there with their name attached to it — all in the interest of making the Snort community a better place.

So, thanks go to the following individuals:

  • Noah Dietrich
  • Yaser Mansour
  • Milad Rezaei

First, we have an updated guide to Snort 2.9.14.1 on CentOS. This guide should work fine for our recently posted 2.9.15.0 release, simply by changing "2.9.14.1" to "2.9.15" where appropriate.

Next, there's an updated guide to Snort 3 installation on CentOS 8.

And we updated the guide to Snort 3 installation on Ubuntu 18 & 19.

As a reminder, our setup and installation guides can be found on Snort's documentation page under "Snort Setup Guides." While you are there, feel free to check out all the other documentation, such as Deployment Guides, startup scripts, and the official Snort manual.

Wednesday, January 9, 2019

Snort.org and the Documentation Saga: A Survey

Cisco users with Firepower Threat Defense (FTD) on an Adaptive Security Appliance (ASA) are running SNORTⓇ, our open-source intrusion protection system, under the hood, along with a suite of other Talos-fueled security processes. Snort monitors traffic by sniffing packets and comparing their contents against tens of thousands of rules written to find all kinds of malware and other malicious activity. Our analysts are constantly creating new rules to cover vulnerabilities in a wide range of products. The highly active open-source community around Snort adds rules for general and niche network configurations, as well.

Thursday, July 5, 2018

Snort 3 Installation Documentation Updates for Ubuntu 14, 16 and 18 posted.



Noah Dietrich, one of the members in the community has submitted this document for hosting on Snort.org. We would like to thank Mr. Dietrich for his efforts and dedication into writing this piece of documentation. If you have any questions in regards to the documentation, please submit it via the author (Mr. Dietrich) or on the Snort.org Users mailing list

As always, our documentation can be found https://www.snort.org/documents

The link directly to the updated doc provided by Mr Dietrich, can be found here.


Thank you again to Mr Dietrich and the community for help making this product / documentation great.




Wednesday, May 30, 2018

Snort 3 installation guide for Ubuntu 14, 16, & 17 has been posted!

Along with the other guides I just posted, I've also updated Noah Dietrich's guide for installing Snort 3 on Ubuntu 14, 16, & 17.

Snort 3 (and all Snort) setup guides can be found on our documentation page.

Thank you Noah!

Snort 3 installation guides for CentOS 7 and FreeBSD 11 have been published!

Thanks to one of our wonderful community members, Yaser Mansour, I've uploaded two new Snort 3 guides for CentOS 7 and FreeBSD 11.

Snort 3 (and all Snort) setup guides can be found on our documentation page.

Thank you Yaser!

Monday, March 5, 2018

Snort 3.0.0-a4 installation guide on OpenSUSE 42.3 has been posted

Thanks to our community member Boris Gomez, I've uploaded his recent copy of an installation guide for Snort 3 on OpenSUSE 42.3 to the Snort Documentation page.

We'll be sending some swag out to Boris very soon.

If you'd like to contribute to the Snort Documentation page, we'd love to hear from you!

Tuesday, December 19, 2017

Setting up Snort 3.0.0 on Ubuntu 14 and 16

A big thanks to our wonderful Snort community member, Noah Dietrich, who was gracious enough to write an installation and setup guide for Snort 3.0.0's most current build (as of today) (b241).

We placed this on the Snort.org Documents page under "Snort Setup Guides".  If you are interested in getting started with Snort 3.0's latest build, please check it out.

Tuesday, August 8, 2017

Snort 2.9.9.x on OpenSuSE Leap 42.2 setup guide has been posted!

Written by community member Boris Gomez, we've posted a setup guide that he provided, for Snort 2.9.9.x on OpenSuSE Leap 42.2.

Please take a look our documentation page, check it out, and let Boris know of any issues you find!

Wednesday, April 26, 2017

Snorter -- an automatic Snort, Barnyard2, and PulledPork installation script.

Snorter

We all know that sometimes, the installation of the latest version of Snort, Barnyard2 and PulledPork could be pretty tedious, specially if you have to install lots of Snorts in different machines.

Cloning Hard Disks is the easy way to do it if all the machines in which we are going to install this IDS are the same but, what happens if you are using different machines, and you want to install Snort in all of them? It doesn’t matter if you install a Snort for PCAP analysis or for using it as IDPS: It’s hard work!

I made a guide some time ago where I explain, step by step, how to install and configure a Snort in a Debian based machine, but it was always the same: too long for the short time I have, chiefly if I wanted to do a fast PCAP analysis to discard malware infections or other network traces, for example. This is why I decided to convert my PDF guide into a bash script, which installs all dependencies and also creates a MySQL database for the alerts.

This is how Snorter was born.

The only thing you need is an Oinkcode, available for free in snort.org webpage, needed for automatically update the Snort rules, and the Network Interface which is going to be used (eth0, wlan0, etc…)

For installing, you only need to clone the repository:
git clone https://github.com/joanbono/Snorter
cd Snorter/src
bash Snorter.sh -o  -i

The script is mostly independent, the only interaction needed for the installation is the specification for the $HOME_NET and the $EXTERNAL_NET, but do not worry, is fully documented in the Manual.
Also, I have added a Dockerfile for testing, with the possibility to use websnort, a web interface which allows the analyst to upload a PCAP file and then see graphically the alerts, and adds to the Snorter an API option for submitting pcaps using curl.

I started this tool with the purpose of making my life easier, but the program has evolved, and now it’s time to share it.

The next step is to port it to Red Hat/CentOS, any help is welcome!

Feel free to open issues, improve the script and add more options, but, above all, enjoy the free time you will have from now.



This was a guest post by --
Joan Bono
IT Security Analyst at Ackcent

Wednesday, October 26, 2016

Integrating Snort 2.9.8.x with AlienVault's OSSIM

Another thanks goes out to Bill Parker, the author for many of excellent Snort guides.

Integrating Snort 2.9.8.x with AlienVault's OSSIM installation guide can be found on our documentation page, so for those of you interested in OSSIM, but are unsure of how to get started, or how to integrate Snort into the offering, please go take a look.

As always, we thank Bill for his documentation contributions, and welcome all documentation contributions for the Snort.org page!

Friday, January 8, 2016

Snort 2.9.8.0 Installation Guides have been posted!

Thanks to our hard working community members William Parker and Noah Dietrich, the installation guides for Snort 2.9.8.0 have been posted on Snort.org!

We love it when our community pitches in and sends us documentation, FAQ updates, startup scripts, hints and tricks (which belong in the FAQ!)

If you'd like to contribute to the documentation repository, just email us at sfcommunity@cisco.com, and we can highlight your work, or, if you'd like to help out with the FAQ, we host it on Github, and allow anyone to submit a pull request against the docs.  Please considering helping out!

Monday, August 3, 2015

Snort 2.9.7.x installation guide for Fedora 22 has been posted!

Thanks so much to Mr. William Parker for his contribution of the Fedora 22 installation guide for Snort 2.9.7.x.

I've posted it under "Snort Setup Guides" on the official Snort Documentation page.

Thanks to Mr. Parker for not only this guide but for all of his contributions on Snort.org!  The community is what makes it work!


Wednesday, March 25, 2015

Snort VIM Configuration posted!

Our own Victor Roemer of the Snort team has taken the time to write up his own VIM configuration for the Snort rules language.

I've posted a link to his github page over on the documentation page under "Additional Resources"

Thanks Victor!

Wednesday, February 25, 2015

Possible Packet Loss issues during reassembly for Snort

William Parker was nice enough to write up this quick white paper on how to diagnose and remediate some possible packet loss issues found during reassembly for Snort.

I've posted the white paper on our documentation page on Snort.org (under Additional Resources) and here's a link to it directly.

Thanks Bill for always contributing great content for the site!

Wednesday, November 26, 2014

Snort FAQ is now on Snort.org!

When the old Snort.org was still around, we had a section for the FAQ on the documents page. However, contributions to the pages involved sending in suggestions to the admins of the site, via email, and then the changes would be shoved onto the site using regular old html, and then the site had to be pushed.

While this worked, it truly wasn't in the same participatory community that has made many open source projects, including ours, truly inclusive of the community. To counter this, the FAQ was moved to github. Here it allowed forking, editing, pull requests, etc, all in the easy to understand format of Markdown.

Since the move we've had several hundred changes submitted by way of pull request through github, as well as people submitting information the old fashioned way, via the mailing list, or email directly to us. However, the FAQ was on github itself, requiring you to visit an external page off of Snort.org, and then somehow navigate back, if you wanted more content on Snort.org such as other documentation.  

We found this experience to be cumbersome and downright awkward. The user experience was bad, and while no one really complained a great deal, we thought we could do better. 

So now, the FAQ is back on Snort.org. While the content is rendered seamlessly on the page, the meat of the information is actually pulled from Github. This allows the best of both worlds, to allow the user experience of github and allow forks, pulls, etc, the content is now beautifully rendered on Snort.org, providing a much better experience. 

We'd like the community to participate, to create pages, update FAQs, and provide content that you believe would help the Snort community.  You may do so by going to Snort's github page, and either forking, making edits, and submitting back to us, or creating a branch and submitting back to us. We'll review the content for integrity and to ensure it is correct, so we don't have bad, incorrect, or mis-information out there. 

The intent is to make Snort.org, truly the home, of Snort and its ecosystem.  There are around 60 known projects out there that participate or create a project to augment Snort, its input, output, or analysis.  I'd love for every one of those projects to have their own section in the FAQ.

Got an answer to a question that is asked every day on Snort's mailing list?  Create an FAQ page for it, let's point people to that.  Wrote some documentation to help people out with turning off LRO on their NIC?  Submit it!

Let's create a documentation repository.  We'll keep it cleaned up, neat and tidy on the site and make sure we are following all the appropriate rules surrounding content as well as layout in Markdown, etc.  But the content should be living, changing, and updated, and I'd love to have everyone participate.

Check out the Snort.org Documentation page, you'll see on the left hand side the "Snort FAQ".  You'll see all the current pages on the FAQ that people have created over the years, as well as the READMEs that are contained in the doc/ section of the Snort tarball.  Along with the Snort Manual that is also linked from the Documentation page, it should be much simpler to find the answers you need to almost any Snort question.  If you want to participate, head on over to the Github page, create your own branch, and start editing!

I'll be moving some of the one-off documentation that we have on Snort.org to the FAQ in coming days.

For a Markdown primer, head on over to Daring Fireball, the creator of the Markdown format.

A big thanks to our web team here in the Talos Group for making this happen!

Wednesday, November 5, 2014

Snort 2.9.7.x Installation Guides have been posted!

Thanks to our friend William Parker who sent me updated 2.9.7.x installation guides for various OSes, I just updated the documentation page.

Please take a look at the documentation page for the latest versions of the installation guides walking you through 2.9.7.x, and now with concurrent Registered Rules releases, you don't have to delay the upgrade!

Thanks.


Wednesday, August 20, 2014

Snort Installation Guide for Debian 7.6 has been posted!

Thanks to Jason Weir of our Snort Community who contributed this document, a set up guide for Snort 2.9.6.2 on Debian 7.6.

The guide has been published (along with our many other great guides!) in our Snort Setup Documentation section on www.snort.org!

Be sure and check it out!

Thanks Jason!

Tuesday, July 15, 2014

OpenAppId Detector Developer Guide has been posted!

If you take a look at the new dedicated section to OpenAppId on Snort.org, at https://www.snort.org/downloads, you will see that we include a new OpenAppId Detector Developer Guide.

This document details the fields necessary to author your own OpenAppId content and put it to use in Snort 2.9.7.0's beta release, also on the downloads page.

We encourage you to download the guide, Snort 2.9.7.0, and the OpenAppId detector content, set it up, take a look, test it out and give us feedback on the OpenAppId mailing list.

We're excited to see what you all are making, and the feedback about OpenAppId has been great.

Friday, May 16, 2014

Snort IPS using the DAQ AFPacket installation guide has been posted!

Thanks to one of our community members, Yaser Mansour!  He authored a simple guy to get Snort up and running as an IPS using the AFPacket DAQ.  I've listed it under "Installation Guides" on the docs page:

https://www.snort.org/documents

Thanks Yaser!  You are what makes the Snort Community wonderful!

Thursday, January 30, 2014

Snort 2.9.6.0's manual has been posted!

As many of you may know, the Snort Manual is always included within the tarball in the /docs directory.

However, I always keep the PDF on http://www.snort.org/docs and the HTML version over at http://manual.snort.org updated as well.  I've just updated the two manuals to the latest version.

Thanks!