WEBVTT

00:00:01.030 --> 00:00:04.500
[Autogenerated] There are many different ways to expand snores capabilities.

00:00:04.590 --> 00:00:09.490
Both Cisco and 3rd Party vendors offer additional tools to

00:00:09.500 --> 00:00:11.700
integrate with snore and use its information.

00:00:12.400 --> 00:00:15.360
It's not just additional tools that we're thinking of here though.

00:00:16.059 --> 00:00:19.690
We'll need to talk about plugins and other integrations as well.

00:00:21.030 --> 00:00:26.360
To start, Snore is fully integrated into Cisco's secure firewall solution.

00:00:26.720 --> 00:00:28.720
We'll talk about this more in a later module.

00:00:29.330 --> 00:00:32.369
Cisco also has various tools that can add to the

00:00:32.369 --> 00:00:35.380
capabilities pulled pork for example,

00:00:35.390 --> 00:00:40.310
helps automate rule management and downloads the pig doctor.

00:00:40.600 --> 00:00:42.300
Yes, that's what it's called.

00:00:42.710 --> 00:00:45.840
Is a tool to parsers and generate information from

00:00:45.840 --> 00:00:47.730
snorts performance metric output.

00:00:48.370 --> 00:00:51.140
Damon logger is essentially a packet sniffer and a

00:00:51.140 --> 00:00:54.790
tap from the third party side.

00:00:55.180 --> 00:00:59.830
Security onion comes to mind as a very popular tool that has snort built

00:00:59.830 --> 00:01:05.410
right into it squeal is a tool that provides a nice GUI to access the

00:01:05.410 --> 00:01:11.360
real time events from the tools base is a tool that is used to query and

00:01:11.360 --> 00:01:13.370
analyze the snore alerts coming in.

00:01:14.030 --> 00:01:17.330
It's built with a web for an end to make it easy to use.

00:01:18.480 --> 00:01:23.140
And speaking of front ends snore B is a front end for snore as well.

00:01:23.360 --> 00:01:24.410
Yeah,

00:01:24.420 --> 00:01:29.220
there's a lot of them besides those additional tools which you can

00:01:29.220 --> 00:01:32.860
find more with a quick web search or by navigating to the snort

00:01:32.860 --> 00:01:38.530
website you have the ability to use plugins plugins give you the easy

00:01:38.530 --> 00:01:41.990
ability to expand the tool itself.

00:01:42.800 --> 00:01:45.610
We'll explore some of these later on in the course,

00:01:45.820 --> 00:01:50.220
but here's the short list of some external or internal plugins Snort

00:01:50.220 --> 00:01:56.500
three has over 200 plugins by default and an example of one is the

00:01:56.500 --> 00:02:00.220
output plugin this is how your data gets to you.

00:02:01.260 --> 00:02:03.940
Besides that there are detection,

00:02:03.940 --> 00:02:10.820
plugins which detect a specific thing in the traffic and pre processors which

00:02:10.830 --> 00:02:16.680
help us defrag reassemble or do other complex functions to the packets better

00:02:17.470 --> 00:02:20.350
the flexible response plugin is really cool as well,

00:02:20.980 --> 00:02:24.880
allowing you to use response actions based on a rule.

00:02:25.750 --> 00:02:29.620
We'll also talk about the open app IDE plugin later on in the course,

00:02:31.150 --> 00:02:34.910
if you want additional information about all of the plugin capabilities

00:02:34.960 --> 00:02:39.170
and other expand ability features with Snort look here,

00:02:39.370 --> 00:02:43.140
the snort documentation library is extensive and can help

00:02:43.140 --> 00:02:45.130
you get going quickly with a lot of this.

00:02:45.830 --> 00:02:50.370
It has a lot of detailed information about setting up snort white papers

00:02:50.370 --> 00:02:54.010
around how to do specific things with it like optimized pattern matches

00:02:54.380 --> 00:02:57.930
and has really good pre processor details,

00:02:58.000 --> 00:02:59.180
go check it out