WEBVTT

00:00:01.030 --> 00:00:03.840
[Autogenerated] the app IDE pre processor is one of my

00:00:03.840 --> 00:00:07.530
favorites as it provides the application information for

00:00:07.530 --> 00:00:09.210
the traffic passing in the network.

00:00:10.220 --> 00:00:13.490
It's interesting how much the security landscape has evolved,

00:00:13.540 --> 00:00:17.310
giving us the need to inspect some application traffic and know what

00:00:17.310 --> 00:00:21.040
the apps are actually doing using this pre processor.

00:00:21.320 --> 00:00:26.810
We're able to have application awareness using application identifiers or app I.

00:00:26.810 --> 00:00:27.030
D.

00:00:27.030 --> 00:00:27.290
S.

00:00:28.210 --> 00:00:32.450
These application identifiers are available to use when writing snort rules.

00:00:32.740 --> 00:00:35.860
We can also see how the application uses the network,

00:00:35.940 --> 00:00:40.120
including band with information about them on top of that.

00:00:40.190 --> 00:00:44.800
You can create your own application detectors for newer custom applications.

00:00:45.120 --> 00:00:50.750
These are written in the lua language when enabling this pre processor,

00:00:50.950 --> 00:00:52.270
there's a few requirements.

00:00:53.210 --> 00:00:57.550
First, the stream pre processor for session tracking has to be enabled.

00:00:58.370 --> 00:01:00.310
Protocol aware flushing and I P.

00:01:00.310 --> 00:01:02.820
D fragmentation need to be enabled as well.

00:01:03.580 --> 00:01:08.740
We'll also need to use the H G D p pre processor to be able to give F I.

00:01:08.740 --> 00:01:11.280
D the http header information.

00:01:11.290 --> 00:01:13.050
Also Luigi.

00:01:13.050 --> 00:01:14.130
It must be installed.

00:01:14.880 --> 00:01:18.360
There's a lot of documentation around the open app IDE pre

00:01:18.360 --> 00:01:20.540
processor and corresponding application i.

00:01:20.540 --> 00:01:20.760
D.

00:01:20.760 --> 00:01:20.980
S.

00:01:21.540 --> 00:01:25.900
In fact there's over 3000 different detectors in the most recent

00:01:25.900 --> 00:01:29.460
releases that help us identify different traffic types.

00:01:30.350 --> 00:01:35.400
There's some pop there's some for popular social media services for airplay.

00:01:35.410 --> 00:01:38.320
Itunes Airbnb to name a few.

00:01:39.370 --> 00:01:42.310
There's a lot of different application detectors available.

00:01:43.170 --> 00:01:45.510
Check out this site at Cisco dot com.

00:01:45.560 --> 00:01:50.080
To search through the various applications and take a look at the risk levels

00:01:50.090 --> 00:01:55.780
and business relevance classifications using this information.

00:01:55.830 --> 00:01:59.360
You can create and add context around the traffic.

00:01:59.700 --> 00:02:04.640
For example, you can create a detection for users on a certain network segment,

00:02:04.690 --> 00:02:08.340
navigating to a music streaming service that's against corporate

00:02:08.340 --> 00:02:13.280
policy or prevent them from playing games that aren't supposed to

00:02:13.280 --> 00:02:15.470
be played while on corporate devices.

00:02:16.390 --> 00:02:20.360
This information is gold from the rule creating perspective and

00:02:20.360 --> 00:02:23.020
really helps to build a story for a traffic.

00:02:23.850 --> 00:02:26.830
It's easy to write a basic rule regarding the app.

00:02:26.830 --> 00:02:29.010
IDE as shown here for slack.

00:02:30.110 --> 00:02:32.160
Once you enable the pre processor,

00:02:32.170 --> 00:02:35.600
you can use the app IDE rule option in your rules,

00:02:35.610 --> 00:02:38.530
we'll see an example of this in the coming demo.