WEBVTT 00:00:01.560 --> 00:00:04.019 [Autogenerated] now it's time to talk about the tool of the 00:00:04.019 --> 00:00:09.050 module hold port this is one that the snort team maintains and 00:00:09.060 --> 00:00:11.180 it's really easy to install and use. 00:00:11.580 --> 00:00:15.430 You'll be able to do many things with it to help with that topic of 00:00:15.430 --> 00:00:17.720 rural management and some of the struggles around it. 00:00:18.560 --> 00:00:22.280 We're going to see it in action and demonstrate how to install 00:00:22.280 --> 00:00:24.430 and use it properly in the coming demos. 00:00:25.590 --> 00:00:29.630 This tool was built originally in pearl for snort too, 00:00:29.670 --> 00:00:32.430 but it's actually written in python for snort three. 00:00:33.300 --> 00:00:38.090 You can install it with mostly standard Python three libraries and it can be 00:00:38.090 --> 00:00:43.070 installed and used on Windows Linux and other UNIX systems. 00:00:43.800 --> 00:00:47.170 The configuration for this is really only in one file. 00:00:47.240 --> 00:00:51.760 The pulled pork dot com file using this configuration file 00:00:51.810 --> 00:00:54.770 were able to define what we want to download, 00:00:54.800 --> 00:00:56.810 what rule sets we want to use, 00:00:56.890 --> 00:01:02.080 which IP block lists to pull and where to store them and the nuances 00:01:02.080 --> 00:01:06.680 around how to look for and handle snore Aside from this, 00:01:06.990 --> 00:01:11.170 the other relevant file is the pulled pork dot python file that 00:01:11.170 --> 00:01:14.940 has the base script for how the tool behaves. 00:01:14.970 --> 00:01:17.820 You shouldn't have to modify that for basic usage, 00:01:18.770 --> 00:01:21.690 here's an example of the pulled pork dot com file. 00:01:22.430 --> 00:01:26.500 It's not the full file but some of the relevant items so that you 00:01:26.500 --> 00:01:28.630 can see the options that are available to you. 00:01:29.550 --> 00:01:31.360 We'll explore this in the demo of course. 00:01:31.500 --> 00:01:34.750 But as you can see you can define which rule sets you can 00:01:34.750 --> 00:01:38.900 download as well as which IP block lists and their locations 00:01:39.830 --> 00:01:41.400 you use this to define the I. 00:01:41.400 --> 00:01:41.610 P. 00:01:41.610 --> 00:01:41.760 S. 00:01:41.760 --> 00:01:46.390 Policy and the rule paths for the rules one cool thing about 00:01:46.390 --> 00:01:49.120 this configuration file is that you can customize the 00:01:49.120 --> 00:01:53.400 directories where the rules and the policy files are stored for 00:01:53.400 --> 00:01:55.420 advanced tool usage and modification. 00:01:57.020 --> 00:02:01.830 Here's the link to go ahead and download the pulled pork tool again. 00:02:01.940 --> 00:02:03.800 It's the GitHub repo for it. 00:02:03.800 --> 00:02:07.880 So you can pull the latest version and view the README and other docs included. 00:02:08.940 --> 00:02:12.490 Let's get started working with pulled pork by installing it in 00:02:12.500 --> 00:02:15.130 this demo we'll jump right into the lab, 00:02:15.180 --> 00:02:18.950 download the package and get it installed and validate that it works. 00:02:20.720 --> 00:02:21.350 All right. 00:02:21.350 --> 00:02:22.900 And welcome back to the lab. 00:02:22.910 --> 00:02:24.450 As I just mentioned in this one, 00:02:24.460 --> 00:02:27.420 we're going to be talking about pulled pork and we'll 00:02:27.430 --> 00:02:29.000 show you how to install and use it. 00:02:29.780 --> 00:02:33.240 Now remember this helps us a lot with the rule management 00:02:33.240 --> 00:02:35.620 piece and automates those downloads for us. 00:02:35.650 --> 00:02:39.240 So let's start out by cloning the pulled Pork three. 00:02:39.240 --> 00:02:40.450 Get repository. 00:02:41.840 --> 00:02:44.370 Now there's two different versions for pulled pork. 00:02:44.370 --> 00:02:47.690 There's the regular pulled pork and then there's pulled pork three. 00:02:47.850 --> 00:02:49.220 Since we're using snort three, 00:02:49.220 --> 00:02:51.720 we need to use the equivalent version for pulled pork. 00:02:51.720 --> 00:02:53.090 So that's why we're using three. 00:02:53.730 --> 00:02:55.580 If you're using two or below in your environment, 00:02:55.580 --> 00:02:58.790 you can go ahead and download the standard pulled pork repository. 00:02:59.680 --> 00:03:00.080 Alright. 00:03:00.080 --> 00:03:04.080 Let's jump into that directory now and let's go ahead and 00:03:04.080 --> 00:03:07.440 make a directory in the bin folder and that's where we're 00:03:07.440 --> 00:03:09.730 gonna be placing a couple of files. 00:03:09.740 --> 00:03:13.840 So we'll go ahead and copy our pulled pork dot pi file over to that 00:03:13.840 --> 00:03:18.180 directory and then we'll go ahead and copy the entire contents of 00:03:18.180 --> 00:03:20.370 the lib directory as well over to there. 00:03:20.970 --> 00:03:21.920 Now that that's done, 00:03:21.920 --> 00:03:25.590 we'll go ahead and modify the permissions for the pulled pork dot pi script. 00:03:26.130 --> 00:03:30.300 Now this is gonna allow us to actually execute the file and then we'll go 00:03:30.300 --> 00:03:34.310 ahead and make a new directory as well in the user local etc. 00:03:34.340 --> 00:03:36.180 Directory for pulled Pork three. 00:03:37.600 --> 00:03:41.850 And we'll go ahead and copy the contents of the repositories, etc. 00:03:41.850 --> 00:03:45.210 Slash pulled pork dot com file over to there. 00:03:46.120 --> 00:03:49.730 Now this comp file is our actual configuration file that will be 00:03:49.740 --> 00:03:53.490 modifying for pulled pork to operate properly. 00:03:54.340 --> 00:03:57.150 Alright, now that pulled pork is installed. 00:03:57.160 --> 00:04:01.510 We can go ahead and test out the configuration parameters just to make sure 00:04:01.510 --> 00:04:06.850 that it starts up properly and it'll run properly to do so we just have to 00:04:06.850 --> 00:04:09.750 call that python script and then do a dash v. 00:04:09.760 --> 00:04:12.590 At the end of the command just like that. 00:04:13.310 --> 00:04:16.410 And there's a couple of errors as far as syntax goes. 00:04:16.420 --> 00:04:22.920 But if we see the diagram below the logo and the information about pulled pork, 00:04:22.930 --> 00:04:26.220 we're able to know that the program runs successfully with the 00:04:26.220 --> 00:04:29.670 configuration now the configuration file that we have doesn't have 00:04:29.670 --> 00:04:31.230 anything in it that's important yet. 00:04:31.230 --> 00:04:32.830 So let's go ahead and edit that now. 00:04:33.470 --> 00:04:34.320 All right. 00:04:34.340 --> 00:04:37.760 Now we're in here in our configuration file for pulled pork. 00:04:37.770 --> 00:04:39.380 And as you can see, 00:04:39.380 --> 00:04:43.440 there's a lot of similar things in here compared to what we've seen before 00:04:43.450 --> 00:04:46.970 in the previous demos where we saw a different rule sets, 00:04:47.000 --> 00:04:51.030 we saw block lists, we have the ability to find the I. 00:04:51.030 --> 00:04:51.250 P. 00:04:51.250 --> 00:04:51.420 S. 00:04:51.420 --> 00:04:52.030 Policy. 00:04:52.030 --> 00:04:54.450 Just like we did in Cisco secure firewall. 00:04:54.490 --> 00:04:57.390 We can control where the rules are stored and so on and 00:04:57.390 --> 00:05:00.390 so forth for this particular demo. 00:05:00.400 --> 00:05:03.090 We're just going to turn on the registered rules 00:05:03.090 --> 00:05:06.230 that and enable a couple options. 00:05:06.240 --> 00:05:09.420 We get to choose which rule sets in which block lists. 00:05:09.430 --> 00:05:13.480 We actually download using pulled pork and we'll talk about the 00:05:13.480 --> 00:05:16.090 differences between these rule sets and the next demo. 00:05:16.640 --> 00:05:20.380 But for now to get our snort installation going with pulled pork, 00:05:20.390 --> 00:05:22.620 I'm just going to turn on those registered rule set. 00:05:22.630 --> 00:05:26.280 Now my point code is needed to be able to download that rule 00:05:26.280 --> 00:05:28.960 set because it's for registered users. 00:05:28.970 --> 00:05:30.910 Now, I don't have a subscription. 00:05:30.920 --> 00:05:33.640 So I'm just going to download that registered rule set. 00:05:34.310 --> 00:05:36.920 I'm also gonna go ahead and download the snort block list 00:05:36.920 --> 00:05:38.630 instead of the emerging threats block list. 00:05:38.630 --> 00:05:41.120 So we can demonstrate later on how we can change that. 00:05:42.360 --> 00:05:44.840 We have a block list path that we can keep there. 00:05:45.280 --> 00:05:46.920 We can define our snort path. 00:05:47.210 --> 00:05:49.800 The pit path for the snort pit as well. 00:05:50.950 --> 00:05:54.960 So let's go ahead and comment that and that should be it. 00:05:56.330 --> 00:06:00.790 So let's go ahead and save that file and exit and now we need to run 00:06:00.790 --> 00:06:05.010 it so we can run this in a similar way as before. 00:06:05.020 --> 00:06:09.750 Using that pulled pork dot hi file and then we can do a dash C 00:06:09.750 --> 00:06:12.060 to designate where the configuration file is. 00:06:12.770 --> 00:06:17.090 So that configuration file is where in the user local etc. 00:06:17.140 --> 00:06:19.490 And then pulled Pork three directory. 00:06:20.020 --> 00:06:20.280 Now, 00:06:20.280 --> 00:06:23.420 once you enter as you designate the configuration file 00:06:23.420 --> 00:06:25.510 that you're gonna use pulled pork with, 00:06:25.520 --> 00:06:28.950 it should go through properly and as you can see mine 00:06:28.950 --> 00:06:31.390 didn't because I forgot the Sudo command. 00:06:32.170 --> 00:06:34.980 So your Linux permissions still apply here. 00:06:34.990 --> 00:06:38.530 But as you saw just now pulled pork sent a command 00:06:38.530 --> 00:06:40.770 to snort to restart its process. 00:06:40.780 --> 00:06:44.160 It wrote rules to the pulled pork rules directory. 00:06:44.170 --> 00:06:47.520 It wrote the block list to its block list directory that we 00:06:47.520 --> 00:06:49.440 had to find in that configuration file. 00:06:50.140 --> 00:06:53.200 So we can actually check those out as well. 00:06:54.090 --> 00:06:56.460 So looking at this pulled pork rules, 00:06:56.480 --> 00:07:00.880 you can see we actually have information about the rules up at the 00:07:00.880 --> 00:07:04.510 top and we have all of the rule sets down below. 00:07:04.630 --> 00:07:09.850 We see when the rule sets were last updated and where any plugins that we 00:07:09.850 --> 00:07:13.680 have are located as well and scrolling through here. 00:07:13.690 --> 00:07:15.030 There's a lot of rules. 00:07:15.040 --> 00:07:18.580 We're obviously not going to go through and identify each one of these 00:07:18.580 --> 00:07:22.580 because there's a whole bunch but we can download these from the Snort 00:07:22.580 --> 00:07:24.860 website so you can look through them at your leisure. 00:07:24.870 --> 00:07:28.990 Or you can use a tool like Cisco secure firewall or the PF sense 00:07:28.990 --> 00:07:33.670 integration to visualize them better in a GUI Now the same concept 00:07:33.670 --> 00:07:36.200 is gonna be here for the list as well. 00:07:36.210 --> 00:07:42.160 We use pulled pork to download the snort block list and as you can see we see 00:07:42.160 --> 00:07:47.110 again when the file was updated what the block list directory is and then we 00:07:47.110 --> 00:07:50.170 actually see the source URL for the block list. 00:07:50.170 --> 00:07:54.040 So this is our threat intelligence download and we actually have all the I. 00:07:54.040 --> 00:07:54.180 P. 00:07:54.180 --> 00:07:56.420 Addresses that snort recommends blocking. 00:07:56.820 --> 00:07:57.600 Alright. 00:07:57.660 --> 00:08:01.660 And now that we have snore actually running with these pulled pork rules, 00:08:01.770 --> 00:08:06.240 it's time to talk about the differences between the rule sets and 00:08:06.240 --> 00:08:08.410 how we can change them using this awesome tool. 00:08:08.670 --> 00:08:10.570 So join me in the next demo