WEBVTT

00:00:01.290 --> 00:00:02.020
[Autogenerated] All right.

00:00:02.180 --> 00:00:04.880
It's time to go explore this pre processor.

00:00:05.550 --> 00:00:07.890
We'll take a look at the configurations that we have for

00:00:07.890 --> 00:00:10.320
this and walk through the use of them.

00:00:10.630 --> 00:00:11.510
Let's hop in.

00:00:13.570 --> 00:00:15.880
All right, welcome back to the lab.

00:00:15.890 --> 00:00:16.280
Now,

00:00:16.290 --> 00:00:19.340
in this one we're going to start talking about those pre

00:00:19.340 --> 00:00:22.400
processors and in this demo specifically we're gonna start

00:00:22.400 --> 00:00:24.930
with the http inspect pre processor.

00:00:25.690 --> 00:00:28.210
Now, if you're using a standard snort installation,

00:00:28.220 --> 00:00:31.520
the path to see the inspection capabilities is in the

00:00:31.520 --> 00:00:36.740
snort dot lua file in the user local etc.

00:00:36.750 --> 00:00:38.180
Snort directory.

00:00:39.470 --> 00:00:40.110
Alright,

00:00:40.120 --> 00:00:45.020
so here's our snort C++ configuration as you can see many of them can be

00:00:45.020 --> 00:00:51.220
used with defaults without any explicit configuration and we should be

00:00:51.220 --> 00:00:54.490
using this as a template for our configuration.

00:00:55.670 --> 00:01:00.050
What's cool is it breaks down each section at the top so you

00:01:00.050 --> 00:01:04.430
know where to navigate to to be able to either change or see the

00:01:04.430 --> 00:01:06.490
different configuration parameters.

00:01:07.560 --> 00:01:10.720
So our defaults as you can see here in the snort dot lua file,

00:01:10.720 --> 00:01:13.460
we have our home that's and stuff configured.

00:01:13.470 --> 00:01:15.300
We're not worried about that.

00:01:15.310 --> 00:01:18.460
Since we're talking about inspection and our pre

00:01:18.460 --> 00:01:23.150
processors now in this second section,

00:01:23.160 --> 00:01:28.020
this inspection configuration section we can control or what

00:01:28.020 --> 00:01:31.890
inspection capabilities are used on this nor instance.

00:01:31.900 --> 00:01:37.170
So all of these are configured with their internal default parameters.

00:01:38.070 --> 00:01:41.470
Our TCP streams are iCmp and IP streams,

00:01:42.160 --> 00:01:46.740
our DNS inspection and net flow inspection are email inspection.

00:01:46.740 --> 00:01:48.750
SSH so on and so forth.

00:01:49.680 --> 00:01:54.270
The snort underscore defaults dot lua configuration file is where a

00:01:54.270 --> 00:01:56.970
lot of those default configurations are configured.

00:01:57.670 --> 00:02:01.870
So the first one that we're gonna go look at is the one for the

00:02:01.880 --> 00:02:07.450
HTTP underscore inspect which uses the default underscore HTTP

00:02:07.450 --> 00:02:09.780
underscore inspect configuration.

00:02:09.789 --> 00:02:11.940
So we'll go check that out in a second.

00:02:12.730 --> 00:02:16.180
But this is where we define what pre processor uses,

00:02:16.180 --> 00:02:20.050
what configuration file, if it's not going to use the defaults.

00:02:20.960 --> 00:02:21.530
Alright.

00:02:21.540 --> 00:02:24.710
If you've gone through the Pluralsight courses on snort,

00:02:24.720 --> 00:02:27.940
you should have a good idea of the rest of the configuration file.

00:02:27.950 --> 00:02:32.330
We have our detections in our filters and the output options as well.

00:02:32.340 --> 00:02:35.580
And here we have our alerts dot Jason output instead of

00:02:35.580 --> 00:02:38.300
using CSV or syslog or any of that.

00:02:38.310 --> 00:02:38.840
All right.

00:02:38.840 --> 00:02:42.560
So, now let's check out our snort defaults dot lua file.

00:02:43.200 --> 00:02:43.530
Now,

00:02:43.530 --> 00:02:47.700
this is that default file that tells us all of the external

00:02:47.700 --> 00:02:50.730
defaults that are built in as we built the system,

00:02:51.640 --> 00:02:55.200
as you can see our servers are defined as being on the home net.

00:02:55.210 --> 00:02:57.720
R http ports are defined here.

00:02:57.720 --> 00:03:02.490
So you can go in and customize these if you like our mail ports or ssh ports.

00:03:02.500 --> 00:03:04.800
So if you're using custom ports in your environment,

00:03:04.800 --> 00:03:06.730
you can come in here and define them.

00:03:07.720 --> 00:03:13.630
So this defines all of our defaults since we're talking about the HTTP inspect.

00:03:13.630 --> 00:03:17.720
Pre processor all of the http methods are defined here to help

00:03:17.720 --> 00:03:24.230
snort process the information and here we have our default

00:03:24.240 --> 00:03:30.060
underscore HTTP underscore inspect configuration parameters that we

00:03:30.060 --> 00:03:32.880
identified in the snort dot lua file.

00:03:34.020 --> 00:03:39.930
So as you can see parameters not specified here, get internal defaults.

00:03:39.940 --> 00:03:44.490
So what we're saying is we're only going to add on this particular

00:03:44.490 --> 00:03:49.610
parameter so if we're going to add in any parameters that either

00:03:49.610 --> 00:03:53.150
override or add on to the internal defaults,

00:03:53.160 --> 00:03:54.760
we would add them here like this one.

00:03:54.770 --> 00:03:59.550
However, if not everything is just going to take the internal defaults.

00:03:59.810 --> 00:04:00.740
Alright, cool.

00:04:00.750 --> 00:04:05.220
So that's all we have configured for the http inspect configuration.

00:04:05.230 --> 00:04:09.480
Keep in mind that Snort three when we're looking at the http inspect

00:04:09.480 --> 00:04:15.720
pre processor looks for the HTTP keyword instead of specific ports

00:04:15.730 --> 00:04:18.910
like Snort too does So the behavior is slightly different between

00:04:18.910 --> 00:04:20.500
snort tunes north three here.

00:04:21.130 --> 00:04:27.210
Now let's go look at our rule for using this HTTP inspect pre processor.

00:04:27.220 --> 00:04:29.990
So I'm going to pull up my local rules file and

00:04:30.000 --> 00:04:31.860
there's not a whole bunch in here.

00:04:32.620 --> 00:04:36.700
Now look at this specific rule that we have configured for bad guys.

00:04:37.250 --> 00:04:41.560
What this rule is saying is if any client on the Home net

00:04:41.570 --> 00:04:46.170
connects to any server on the external net using http ports

00:04:46.180 --> 00:04:49.760
and the content has bad guys in it,

00:04:49.770 --> 00:04:52.650
then we're going to send an http alert message using

00:04:52.650 --> 00:04:55.030
the security i P S alert policy.

00:04:55.670 --> 00:04:58.430
So as snorts processing the data,

00:04:58.440 --> 00:05:01.810
it's going to look for specific criteria that we define in the

00:05:01.810 --> 00:05:05.350
conversation and alert us if that's true or not.

00:05:05.360 --> 00:05:08.660
So in this case if we navigate to something like internet bad

00:05:08.660 --> 00:05:11.910
guys dot com snort will give us an alert.

00:05:12.340 --> 00:05:13.630
So let's test this out.

00:05:14.370 --> 00:05:17.800
Let's go back to our browser and in a new tab,

00:05:17.810 --> 00:05:22.340
let's navigate to internet Bad guys dot com Now it's only a

00:05:22.340 --> 00:05:26.520
demonstration site and it's using just standard http,

00:05:26.530 --> 00:05:27.890
not https.

00:05:27.940 --> 00:05:28.680
Now,

00:05:28.680 --> 00:05:33.520
let's go over to Kibana and see if we have anything in our

00:05:33.530 --> 00:05:37.790
snort data that shows that we can use just a standard search

00:05:37.790 --> 00:05:42.390
to search for the term bad guy, but it might not pull up anything.

00:05:42.400 --> 00:05:45.520
What about HTTP We have eight hits.

00:05:46.560 --> 00:05:48.280
Well, check out these messages in a second,

00:05:48.280 --> 00:05:53.820
but let's hop back over to our cli and look at our snort logs and

00:05:53.820 --> 00:05:56.420
let's grab for what that message is going to say.

00:05:56.430 --> 00:05:58.380
Right, HTTP alert.

00:05:58.920 --> 00:06:02.160
As you can see, we have HTTP alert here.

00:06:02.170 --> 00:06:04.590
So now let's hop over and look at the message in

00:06:04.590 --> 00:06:07.780
Kibana let's search for that string.

00:06:07.790 --> 00:06:14.990
HTTP alert and that's not pulling up so we can look at the MsG field here,

00:06:15.000 --> 00:06:17.920
the message field and see what that brings up.

00:06:18.460 --> 00:06:23.590
So we have a filter for the message field and as you can see we have HTTP alert.

00:06:23.600 --> 00:06:27.000
So let's add that as a filter and we only have two

00:06:27.000 --> 00:06:32.180
hits now looking at the message, we have our addresses,

00:06:32.190 --> 00:06:34.110
especially the destination address,

00:06:34.120 --> 00:06:37.490
we have all that same information that we went over earlier and

00:06:37.490 --> 00:06:40.330
then we have our message for HTTP alert here,

00:06:41.370 --> 00:06:44.780
we have what the source address was, The poor information.

00:06:44.780 --> 00:06:45.350
The rule I.

00:06:45.350 --> 00:06:45.630
D.

00:06:45.630 --> 00:06:46.260
Information.

00:06:46.260 --> 00:06:50.190
And since this is a custom rule, that's my custom rule,

00:06:50.190 --> 00:06:51.860
IDE that we created for it.

00:06:53.260 --> 00:06:57.990
So that's an example of the http inspect pre processor.

00:06:58.000 --> 00:07:04.030
It takes the conversation and looks for specific content when the messages

00:07:04.030 --> 00:07:09.640
are tagged with HTTP Because snorts http inspect pre processors looking for

00:07:09.640 --> 00:07:12.890
that HTTP string instead of the poor numbers.

00:07:12.890 --> 00:07:15.880
So it knows that it's going to process that using the

00:07:15.880 --> 00:07:19.110
http underscore inspect pre processor.

00:07:19.790 --> 00:07:22.770
All right, let's move on to the flow ports.

00:07:22.770 --> 00:07:23.970
Can pre processor.