WEBVTT 00:00:01.630 --> 00:00:03.950 [Autogenerated] Alright now that we have the extras 00:00:03.950 --> 00:00:06.200 package built and installed properly. 00:00:06.440 --> 00:00:08.920 Let's go explore it and better yet, 00:00:09.170 --> 00:00:13.830 let's check out one of the example plugins Alright, 00:00:14.210 --> 00:00:15.660 now let's add on to this. 00:00:15.730 --> 00:00:20.280 Let's look for statistics for the different applications in the network. 00:00:20.800 --> 00:00:26.110 Now keep in mind we're about to use the Snort Plus Plus extras this original 00:00:26.110 --> 00:00:31.970 app IDE plugin it came default with snort but it wasn't activated yet and we 00:00:31.970 --> 00:00:35.810 just activated it and created a rule to detect Twitter So now let's go ahead 00:00:35.810 --> 00:00:38.390 and modify our snort dot lua again. 00:00:38.400 --> 00:00:41.730 Now, just underneath where we configured the app I. 00:00:41.730 --> 00:00:46.600 D section, we're gonna go ahead and add in an app IDE listener. 00:00:47.160 --> 00:00:51.330 All right, and your configuration should look something similar to this. 00:00:51.340 --> 00:00:56.030 You can designate a different file if you want to to have the listener log its 00:00:56.040 --> 00:00:59.880 information to but I'm just using this one right here now. 00:00:59.880 --> 00:01:06.210 I'll save it and exit now before we actually turn that on and use it now 00:01:06.210 --> 00:01:11.270 we need to turn it on and use it to do So I'm just gonna stop snort real 00:01:11.270 --> 00:01:14.280 quick and let's check the status real quick. 00:01:15.180 --> 00:01:15.660 Okay, 00:01:15.670 --> 00:01:20.400 it's an active so I have my snort service starting 00:01:20.400 --> 00:01:23.620 up with a typical startup script. 00:01:23.630 --> 00:01:27.670 Calling the plugins and the configuration files that I'm using in my 00:01:27.670 --> 00:01:33.290 environment to add on an additional plugin we'll need to add that to 00:01:33.290 --> 00:01:35.730 the startup script or to whatever. 00:01:35.730 --> 00:01:39.580 Starting snort whether it's a command or a script or you're starting it in 00:01:39.580 --> 00:01:44.390 some other way and so you can modify those startup scripts and stuff like 00:01:44.390 --> 00:01:48.460 that to include the plugins that we just added when we installed these snort 00:01:48.460 --> 00:01:54.470 Plus Plus extras package or you could just type out the command and have it 00:01:54.470 --> 00:01:56.130 run on its own that way. 00:01:56.140 --> 00:01:57.590 And so that's what we're gonna do. 00:01:57.600 --> 00:02:01.780 I stopped the service and now we're just gonna run a single instance of snort 00:02:01.790 --> 00:02:05.150 using the command to run it with my configuration files. 00:02:05.710 --> 00:02:09.380 So that's my snort command to get the system up and running and we're 00:02:09.380 --> 00:02:12.400 gonna add on another piece of it called the plugin path. 00:02:12.980 --> 00:02:16.540 Now remember where the installation put all of our plugin extras, 00:02:16.540 --> 00:02:17.770 it was this directory. 00:02:17.780 --> 00:02:23.180 So this is where we actually add that information in and looking at this. 00:02:23.350 --> 00:02:25.070 It's already collecting some information. 00:02:25.070 --> 00:02:28.740 Right, let's go ahead and go to Twitter again. 00:02:29.610 --> 00:02:31.280 Let's go ahead and stop snort then. 00:02:32.660 --> 00:02:33.760 All right. 00:02:33.770 --> 00:02:36.590 And now that snort has exited. 00:02:36.600 --> 00:02:40.310 As you can see we have some applications that were detected 00:02:40.310 --> 00:02:42.370 as well under the app IDE statistics, 00:02:42.380 --> 00:02:45.980 so that's really cool that we're able to see that we have 00:02:45.990 --> 00:02:48.060 the number of payloads that were detected, 00:02:48.070 --> 00:02:51.820 We have what the applications were and as you can see we 00:02:51.820 --> 00:02:53.920 have the twitter one right there for one and then a whole 00:02:53.920 --> 00:02:58.120 bunch of DNS ones HTTPS one, so on and so forth. 00:02:59.310 --> 00:03:02.940 So it's really cool that we could see that Alright. 00:03:02.940 --> 00:03:05.940 The last thing that I wanted to show you is some of the other plug 00:03:05.940 --> 00:03:08.200 ins that are available with the extras package. 00:03:08.200 --> 00:03:12.410 So let's go ahead and do this Snort command and then list the 00:03:12.410 --> 00:03:16.820 plugins and wow look at all these that are available like I said 00:03:16.820 --> 00:03:19.360 before we have some that are policy selectors, 00:03:19.360 --> 00:03:21.920 some that are search engines, some loggers, 00:03:21.930 --> 00:03:23.310 some I. 00:03:23.310 --> 00:03:23.530 P. 00:03:23.530 --> 00:03:27.830 S options even and then additional inspectors and codex here. 00:03:27.840 --> 00:03:33.670 So this extras pack gives us plenty of plugins to play with and on top of that 00:03:33.670 --> 00:03:40.190 we have all of these snort default plugins that we can use as well keep in mind 00:03:40.190 --> 00:03:44.180 that you can always look at the documentation for what plugins are available 00:03:44.180 --> 00:03:48.280 where they are and how to use them so you can tie your own applications into 00:03:48.280 --> 00:03:53.400 them or create additional capabilities yourself using these templates or 00:03:53.400 --> 00:03:55.700 defaults so keep that in mind. 00:03:55.710 --> 00:04:00.560 And now we have our system that's operational with application detectors, 00:04:00.570 --> 00:04:04.440 JSON logging and some additional plugin capabilities that 00:04:04.440 --> 00:04:06.840 we downloaded with the extras package for things like 00:04:06.840 --> 00:04:08.510 statistics around the applications. 00:04:10.550 --> 00:04:14.150 I'm so glad that we were able to see that app IDE plugin work. 00:04:14.860 --> 00:04:18.880 There are so many different things that you can do with the snort plugins they 00:04:18.880 --> 00:04:23.600 truly make the tool more and more useful in this module. 00:04:23.670 --> 00:04:27.360 We learned all about the Snort plus plus extras package 00:04:27.370 --> 00:04:29.820 or the snort three extras package. 00:04:30.020 --> 00:04:33.330 This is a set of free plugin examples that work with one of 00:04:33.330 --> 00:04:37.980 snorts over 200 plugins we learned how to install it and how to 00:04:37.980 --> 00:04:39.820 configure it for use with the app. 00:04:39.820 --> 00:04:42.780 IDE Inspector to collect application stats. 00:04:43.480 --> 00:04:46.650 We'll be wrapping up the course soon, but before we do, 00:04:46.840 --> 00:04:48.470 we have a bit more to cover. 00:04:49.060 --> 00:04:51.970 Managing rules and rule sets can be difficult. 00:04:52.120 --> 00:04:56.270 So you'll learn all about a tool called Polled port join me 00:04:56.280 --> 00:04:58.500 in the next module to learn all about it.