WEBVTT

00:00:01.360 --> 00:00:04.710
[Autogenerated] Welcome back we covered a lot in the previous

00:00:04.710 --> 00:00:07.100
module with the pre processor discussion,

00:00:07.540 --> 00:00:09.810
we'll continue our discussion about extending snorts

00:00:09.810 --> 00:00:13.050
capabilities in this one by talking about the snort.

00:00:13.050 --> 00:00:18.850
plugins Plugins were introduced in snort version 1.5.

00:00:19.850 --> 00:00:23.720
That was a while ago and they're still used extensively today.

00:00:24.340 --> 00:00:26.900
In fact they've only become better and better.

00:00:27.830 --> 00:00:32.540
The plugin started out as either detection, plugins or pre processors.

00:00:33.460 --> 00:00:36.740
We already covered the ladder a lot detection.

00:00:36.740 --> 00:00:42.200
plugins though are looking for a single aspect of a packet With Snort

00:00:42.200 --> 00:00:46.130
three were able to utilize the full plugin system.

00:00:46.890 --> 00:00:51.420
Snort to for context only provided pre processor and

00:00:51.420 --> 00:00:56.550
output plugins So we have more to work with here if you're

00:00:56.550 --> 00:00:58.890
programming savvy and you know,

00:00:58.900 --> 00:01:04.819
C++ or lua you can develop your own plugins snort provides

00:01:04.819 --> 00:01:07.740
the plugin examples that will work with later in the module

00:01:07.920 --> 00:01:09.400
to assist with the process.

00:01:10.270 --> 00:01:11.010
These example,

00:01:11.010 --> 00:01:15.180
plugins are great because they allow you to test out pre built ones and

00:01:15.180 --> 00:01:17.770
see how they operate with snore in your environment.

00:01:18.650 --> 00:01:21.000
They're free to download and use as well.

00:01:21.720 --> 00:01:24.470
So what do plugins actually provide us though.

00:01:25.410 --> 00:01:28.400
Take that output plug an example that we discussed earlier

00:01:28.400 --> 00:01:33.220
in the course it provides a way to get the data to you or

00:01:33.220 --> 00:01:34.590
whatever entity wants it.

00:01:35.500 --> 00:01:37.690
You can create the CSV files,

00:01:37.950 --> 00:01:44.280
create logs in many formats including JSON create a TCP dump file and

00:01:44.280 --> 00:01:46.990
there's many other ways to get the data to you.

00:01:47.850 --> 00:01:53.270
These are all plugins they're written for their specific purposes and only

00:01:53.270 --> 00:01:59.720
turned on or modified when the situation or use case permits In Snort three

00:01:59.940 --> 00:02:02.980
you can plug different areas of snort operations.

00:02:03.820 --> 00:02:08.520
You can use the codec plugins to encode and decode protocols.

00:02:09.370 --> 00:02:12.340
The data plugin provides more configurations to use

00:02:12.340 --> 00:02:15.070
with the pre processors or inspectors.

00:02:15.690 --> 00:02:18.850
You can plug your own inspector just like you could

00:02:18.850 --> 00:02:20.770
with the pre processors and snort too.

00:02:21.940 --> 00:02:23.970
Plugging the I PS options and I.

00:02:23.970 --> 00:02:24.140
P.

00:02:24.140 --> 00:02:24.280
S.

00:02:24.280 --> 00:02:29.410
Actions are possible as well as the search engine for faster pattern matching.

00:02:30.470 --> 00:02:31.130
Finally,

00:02:31.140 --> 00:02:35.130
in snort three you can use plugins with the event handlers which

00:02:35.130 --> 00:02:37.960
are the outputs like we discussed and the S.

00:02:37.960 --> 00:02:38.100
O.

00:02:38.100 --> 00:02:40.650
Rules which are those dynamic rules.