WEBVTT

00:00:01.080 --> 00:00:02.880
[Autogenerated] it's time to hop into the lab again

00:00:02.880 --> 00:00:04.840
and check out another pre processor.

00:00:05.490 --> 00:00:09.250
This is the one that we just talked about the ports can pre processor,

00:00:09.300 --> 00:00:14.600
we'll explore the configurations for this then test it out and see it in action.

00:00:14.610 --> 00:00:15.740
Let's hop in.

00:00:18.030 --> 00:00:18.900
Alright.

00:00:18.910 --> 00:00:21.710
We're back in the lab now that we've talked about

00:00:21.710 --> 00:00:23.690
the flow ports can pre processor.

00:00:23.690 --> 00:00:27.950
Let's go check out those capabilities real quick and then do another

00:00:27.950 --> 00:00:31.460
test to show that we can use it with rule sets as well.

00:00:32.170 --> 00:00:33.880
So while we're here,

00:00:33.890 --> 00:00:37.400
the first thing that I'm going to do is show you the

00:00:37.410 --> 00:00:39.070
rules at the bottom about scans.

00:00:39.840 --> 00:00:44.330
So let's go explore the snort dot lua file again and

00:00:44.330 --> 00:00:47.730
let's look for the flow ports, can inspection settings.

00:00:48.750 --> 00:00:52.770
We have a little bit of information up here for pork skin for

00:00:52.770 --> 00:00:55.260
the default med pork skin configuration.

00:00:56.600 --> 00:00:59.340
And then if we go over to the snort defaults dot lua

00:01:02.510 --> 00:01:04.550
and we go close to the bottom.

00:01:05.920 --> 00:01:11.560
We have the TCP med ports here which is part of the

00:01:11.560 --> 00:01:13.750
configuration for the ports can defaults.

00:01:14.420 --> 00:01:19.780
So this whole section here is all about those pork skin defaults and

00:01:19.780 --> 00:01:22.060
this is what we're using in our configuration.

00:01:23.320 --> 00:01:27.670
So what this does is it defines all of the different variables for

00:01:27.680 --> 00:01:31.080
which parameters we want to use to detect ports,

00:01:31.080 --> 00:01:34.080
scans or using the TCP main ports.

00:01:34.090 --> 00:01:36.610
So the criteria is pretty high to flag this.

00:01:37.410 --> 00:01:39.090
Not as bad as the high porch though,

00:01:39.750 --> 00:01:45.460
as you can see these are classified between TCP UDP and IP and we have low

00:01:45.460 --> 00:01:50.580
medium and high detection capabilities and then we have the different

00:01:50.580 --> 00:01:54.850
parameters that tie all of those configurations together.

00:01:55.700 --> 00:01:58.980
And if you remember when we're looking at the snort dot lua file,

00:01:58.990 --> 00:02:01.830
we were using the default medium ports scan settings.

00:02:01.830 --> 00:02:05.000
So this is what we're looking for when we're doing a porch scan

00:02:05.010 --> 00:02:08.270
to be able to identify when it's happening.

00:02:09.490 --> 00:02:14.170
And so essentially what this flow ports can pre processor does for us.

00:02:14.180 --> 00:02:18.510
Like we explained in the slides a little while ago is it ties all of

00:02:18.510 --> 00:02:23.200
these detection capabilities together and looks for patterns in the

00:02:23.200 --> 00:02:25.740
activity to identify a potential scan.

00:02:26.520 --> 00:02:27.070
All right.

00:02:27.070 --> 00:02:31.720
So let's tail our alerts dot Jason file so we can see if a poor

00:02:31.720 --> 00:02:36.390
scans detected and we'll run our porch scan.

00:02:38.260 --> 00:02:39.050
Alright.

00:02:39.060 --> 00:02:40.760
And that porch skin worked.

00:02:40.770 --> 00:02:43.270
So let's go ahead and exit that.

00:02:44.940 --> 00:02:46.260
Now let's look through our logs.

00:02:46.260 --> 00:02:49.490
But let's use Kibana to visualize it a little bit better.

00:02:49.500 --> 00:02:56.300
So let's get rid of the HTTP alert, search strings and filters refresh that.

00:02:57.080 --> 00:03:02.520
Now let's look and see what we have for messages we have ICMP traffic detected.

00:03:02.630 --> 00:03:07.150
We have TCP ports can and it looks like that ports can

00:03:07.150 --> 00:03:09.890
triggered another rule that we had for telnet.

00:03:10.050 --> 00:03:13.250
But let's filter around this ICMP traffic detected.

00:03:13.880 --> 00:03:19.160
That's our custom rule that helps us detect ICMP activity but

00:03:19.160 --> 00:03:21.410
that's not what we're looking at for our pork skin.

00:03:22.280 --> 00:03:24.880
Let's look at the TCP ports can one.

00:03:24.890 --> 00:03:29.170
So this was detected using snorts standard configuration for

00:03:29.170 --> 00:03:32.410
the default medium ports scan setting.

00:03:33.270 --> 00:03:36.710
And as you can see our destination address was our snort box.

00:03:36.710 --> 00:03:40.090
The 30.5 that we had our external host.

00:03:40.100 --> 00:03:41.160
Do the ports can on.

00:03:41.870 --> 00:03:42.770
We have a rule I.

00:03:42.770 --> 00:03:43.000
D.

00:03:43.000 --> 00:03:44.820
The 1 22 11.

00:03:44.950 --> 00:03:48.470
And we have our source address which is outside of our Globomantics network,

00:03:48.470 --> 00:03:49.520
the 10.40.

00:03:50.040 --> 00:03:55.030
So what snort did was it took all of the packet information that it

00:03:55.030 --> 00:03:59.940
collected from this host and used the flow ports can pre processor to

00:03:59.940 --> 00:04:03.670
identify patterns in the traffic and understand that one host was

00:04:03.670 --> 00:04:05.130
doing a porch scan on another.

00:04:05.990 --> 00:04:09.320
Alright now let's talk about application pre processors.