WEBVTT

00:00:00.960 --> 00:00:03.350
[Autogenerated] it's time to talk about one of the topics

00:00:03.360 --> 00:00:08.180
that's on everybody's mind the rules or more specifically

00:00:08.189 --> 00:00:09.740
the rule management piece.

00:00:10.470 --> 00:00:14.550
Think about it, you might have a lot of rules to the tune of thousands.

00:00:14.820 --> 00:00:18.040
How do you keep them all straight and manage them properly?

00:00:18.900 --> 00:00:22.290
We're going to learn about one very specific rule management

00:00:22.290 --> 00:00:25.810
tool called Polled port three in the next clip,

00:00:25.830 --> 00:00:29.120
but let's take some time to learn about the rule defaults

00:00:29.130 --> 00:00:30.990
and some other management techniques.

00:00:30.990 --> 00:00:31.530
First,

00:00:32.170 --> 00:00:36.050
there are four default rule policies that you can use to

00:00:36.050 --> 00:00:40.600
either count Azure policy or build your policy off of as a

00:00:40.600 --> 00:00:43.370
base their connectivity over security,

00:00:43.380 --> 00:00:48.070
balanced security over connectivity and maximum detection.

00:00:48.950 --> 00:00:52.680
We saw a little bit of configuration from two of these in an earlier module.

00:00:53.600 --> 00:00:58.870
Here's what each of them really means to us connectivity over security

00:00:59.000 --> 00:01:02.700
provides rule states that favor performance over security,

00:01:03.550 --> 00:01:05.980
it typically won't have many false positives.

00:01:06.990 --> 00:01:11.030
The balanced policy is one that's recommended for initial deployments,

00:01:11.500 --> 00:01:15.270
aiming to balance both the connectivity and security needs.

00:01:16.340 --> 00:01:21.090
The security over connectivity policy focuses more on security

00:01:21.090 --> 00:01:24.410
and include CVSs scores of eight and above.

00:01:25.180 --> 00:01:29.380
And finally that maximum detection includes all of

00:01:29.380 --> 00:01:31.360
the rules and the other policies.

00:01:32.400 --> 00:01:36.330
Rule updates is one management task that can be so cumbersome

00:01:36.910 --> 00:01:39.880
with the constantly changing security landscape.

00:01:40.210 --> 00:01:43.830
You'll need to be able to have consistent updates to your snort rules.

00:01:44.590 --> 00:01:48.590
This will enable you to detect new and emerging threats more quickly.

00:01:49.300 --> 00:01:53.330
Keep in mind that you can automate the rule downloads to assist with this.

00:01:53.940 --> 00:01:57.180
Several of the GUI integrations that we've discussed do this

00:01:57.180 --> 00:02:00.000
for you or at least are configurable for it.

00:02:01.280 --> 00:02:02.860
Besides the GUI tools,

00:02:02.900 --> 00:02:06.260
you can create things like Cron jobs and other automation

00:02:06.260 --> 00:02:09.919
techniques to download or replace rules and rule sets,

00:02:10.630 --> 00:02:14.330
but think about how difficult it would be to manage rules

00:02:14.330 --> 00:02:16.860
and rule sets using techniques like this,

00:02:17.830 --> 00:02:21.170
you'll have various Cron jobs or automation scripts in the

00:02:21.170 --> 00:02:23.530
environment that you need to maintain and track.

00:02:23.830 --> 00:02:29.840
The alternative is those GUI tools or something like pulled pork intelligence.

00:02:29.840 --> 00:02:33.090
And emerging threats are big things as well,

00:02:33.140 --> 00:02:36.460
things like IP block lists and emerging threat rules can

00:02:36.460 --> 00:02:40.180
provide mechanisms for adding these into the mix by

00:02:40.180 --> 00:02:42.170
intelligence and emerging threats.

00:02:42.180 --> 00:02:46.700
I'm talking more about automated intelligence downloads for new rules,

00:02:46.710 --> 00:02:51.580
new IOPS being blocked and even new plugins or pre processors.

00:02:51.610 --> 00:02:56.050
Now there's ways you can expand snort to be able to utilize

00:02:56.060 --> 00:02:58.130
and in just actual threat intelligence.

00:02:58.650 --> 00:03:01.950
But in this context we're talking about new rules for

00:03:01.950 --> 00:03:03.470
those newly discovered attacks.

00:03:03.550 --> 00:03:09.060
These all expands towards functionality and as we'll see in the coming demos,

00:03:09.060 --> 00:03:13.010
you can manually or automatically download and apply them