Snort++ Build 217 Available Now on Snort.org!

Snort++ build 217 is now available on snort.org.  This is the latest monthly update available for download.  You can also get the latest updates from github (snortadmin/snort3) which is updated weekly.

DAQ Changes:

• updated DAQ - you *must* use DAQ 2.2.1
• build: remove lingering libDAQ #ifdefs
• expected: push expected flow information through the DAQ module
• add libDAQ version to snort -V output

Enhancements:

• add inspector events from http_inspect to appid
• add build configuration for thread sanitizer
• added module trace facility
• add support http file upload processing and process decode/detection depths
• add rev to rule latency logs

• port dce_udp fragments
• port block malware over ftp for clients/servers that support REST command
• port dce_udp packet processing
• port sip changes to avoid using NAT ip when calculating callid
• port dce_udp autodetect and session creation
• update appid to 2983

Bug Fixes:

• fix appid error messages
• fix flow reinitialization after expiration
• fix release of blocked flow
• fix 129:16 false positive
• fix various unit test leaks
• fix -Wmaybe-uninitialized issues
• fix related to appid name with space and SSL position
• fix various appid patterns and counts
• fix fast pattern selection
• fix file hash pruning issue
• fix rate_filter action config and apply_to clean up
• fix static analysis issues
• fix analyzer/pig race condition
• fix explicit obfuscation disable not working
• fix ftp_data: Gracefully handle cleared flow data
• fix LuaJIT rule option memory leak of plugin name
• fix various appid issues - initial port is nearing completion
• fix http_inspect event 119:66
• fix ac_full initialization performance
• fix stream_tcp left overlap on hpux, solaris
• fix/remove 129:5 ("bad segment") events
• file_mempool: fix initializing total pool size
• fix bpf includes
• fix builds for OpenSolaris

Other Changes:

• build: clean up some ICC warnings
• change search_engine.debug_print_fast_pattern to show_fast_patterns
• overhaul appid for multiple threads, memory leaks, and coding style
• expected: expected cache revamp and related bugfixes
• ftp_data: add expected data consumption to set service name and fix bugs
• defaults: update FTP default config based on Snort2's hardcoded one
• rename default_snort_manual.* to snort_manual.*
• build docs only by explicit target (make html|pdf|text)
• update default manuals to build 213
• tolerate more spaces in ip lists
• change default latency actions to none
• deleted non-functional extra decoder for i4l_rawip

Please submit bugs, questions, and feedback to bugs@snort.org or the Snort-Users mailing list.

Happy Snorting!

The Snort Release Team

Snort++ Update

Pushed (last Friday) build 217 to github (snortadmin/snort3):

• update appid to 2983
• add inspector events from http_inspect to appid
• fix appid error messages
• fix flow reinitialization after expiration
• fix release of blocked flow
• fix 129:16 false positive

Snort OpenAppID Detectors have been updated!

An update has been released today for the Snort OpenAppID Detector content. This release, build 272, includes

• A total of 2,813 detectors. 
• It also includes some additional detectors that came in from the open source community. For more details on which contributions were included, we have added them in the AUTHORS file in this package.

Available now for download from our downloads page, we look forward to you downloading and using the new features of 2.9.8.4's OpenAppID preprocessor and sharing your experiences with the community.

The OpenAppID community has a mailing list specifically dedicated to the exchange and discussion of detector content.  Please visit the mailing lists page to sign up.

Snort Subscriber Rule Set Update for 10/27/2016

Just released:
Snort Subscriber Rule Set Update for 10/27/2016


We welcome the introduction of the newest rule release from Talos. In this release we introduced 35 new rules and made modifications to 6 additional rules.

There were no changes made to the snort.conf in this release.

Talos would like to thank the following individuals for their contributions, their rules are included in the Community Ruleset:

Yaser Mansour
40549
40550
40551
40559


Talos's rule release:

Talos has added and modified multiple rules in the file-pdf, indicator-compromise, malware-cnc, os-linux, os-windows and server-other rule sets to provide coverage for emerging threats from these technologies.

In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://www.snort.org/products. Make sure and stay up to date to catch the most emerging threats!

Integrating Snort 2.9.8.x with AlienVault's OSSIM

Another thanks goes out to Bill Parker, the author for many of excellent Snort guides.

Integrating Snort 2.9.8.x with AlienVault's OSSIM installation guide can be found on our documentation page, so for those of you interested in OSSIM, but are unsure of how to get started, or how to integrate Snort into the offering, please go take a look.

As always, we thank Bill for his documentation contributions, and welcome all documentation contributions for the Snort.org page!

Crontabs, and how to fix them

In previous blog entires you've heard me talk about the need to stagger your crontabs to lighten the load on Snort.org at certain times of the day.

We've taken the liberty of creating a section on the oinkcode page about how to configure your crontab.

If you log into Snort.org, click on your user account email address (found at the top right of the page).

Navigate to "Oinkcode" on the left hand side:



Follow the link to:



You will see instructions for how to use your oinkcode, however, we've added a new section under:



This will give you some default syntax for your crontab entry, along with a randomized time (it changes every time you refresh the page, so you can actually place a different time on all your sensors if you so choose) for pulledpork to execute.

Please replace your crontab entry with one of our randomized times from the website, and that should lower the loads on downloads.

Thanks!

Snort Subscriber Rule Set Update for 10/25/2016, Release 2

Just released:
Snort Subscriber Rule Set Update for 10/25/2016


We welcome the introduction of the newest rule release from Talos. In this release we introduced 2 new rules and made modifications to 0 additional rules.

There were no changes made to the snort.conf in this release.



Talos's rule release:

Talos has added and modified multiple rules in the file-flash rule sets to provide coverage for emerging threats from these technologies.

In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://www.snort.org/products. Make sure and stay up to date to catch the most emerging threats!

Snort Subscriber Rule Set Update for 10/25/2016

Just released:
Snort Subscriber Rule Set Update for 10/25/2016


We welcome the introduction of the newest rule release from Talos. In this release we introduced 27 new rules and made modifications to 0 additional rules.

There were no changes made to the snort.conf in this release.

Talos would like to thank the following individuals for their contributions, their rules are included in the Community Ruleset:

Yaser Mansour
40541


Talos's rule release:

Talos has added and modified multiple rules in the blacklist, file-image, malware-cnc, os-linux, protocol-scada and server-webapp rule sets to provide coverage for emerging threats from these technologies.

In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://www.snort.org/products. Make sure and stay up to date to catch the most emerging threats!

Snort++ Update

Pushed build 216 to github (snortadmin/snort3):

• add build configuration for thread sanitizer
• port dce_udp fragments
• build: clean up some ICC warnings
• fix various unit test leaks
• fix -Wmaybe-uninitialized issues
• fix related to appid name with space and SSL position

Snort Subscriber Rule Set Update for 10/20/2016

Just released:
Snort Subscriber Rule Set Update for 10/20/2016


We welcome the introduction of the newest rule release from Talos. In this release we introduced 25 new rules and made modifications to 50 additional rules.

There were no changes made to the snort.conf in this release.



Talos's rule release:

Talos has added and modified multiple rules in the app-detect, blacklist, browser-ie, exploit-kit, file-flash, file-pdf, indicator-compromise, indicator-obfuscation, malware-cnc, malware-other, pua-adware and server-webapp rule sets to provide coverage for emerging threats from these technologies.

In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://www.snort.org/products. Make sure and stay up to date to catch the most emerging threats!