WEBVTT

00:00:01.100 --> 00:00:02.910
[Autogenerated] now that we have the tool installed.

00:00:03.000 --> 00:00:05.410
Let's go back into the lab and show the usage of

00:00:05.410 --> 00:00:09.410
pulled pork to modify the rule sets, let's hop in.

00:00:10.490 --> 00:00:14.650
Alright and welcome back to the lab in this last one,

00:00:14.660 --> 00:00:19.900
we just went over how we can use pulled pork to automatically download and

00:00:19.900 --> 00:00:23.230
modify the rule sets that we're actually using in snore.

00:00:24.060 --> 00:00:27.220
Now we're gonna go back into the pulled pork configuration

00:00:27.220 --> 00:00:31.570
file and see how we can modify those or change them around

00:00:31.580 --> 00:00:33.410
and what the impacts of that is.

00:00:34.520 --> 00:00:39.520
So let's first start out by navigating to the snort website and

00:00:39.530 --> 00:00:41.800
let's talk about rule subscriptions first.

00:00:42.640 --> 00:00:45.410
Now there's a couple different ways you can

00:00:45.410 --> 00:00:48.210
download the rule sets that snort has,

00:00:48.220 --> 00:00:51.850
there's a community rule set that's free for all users.

00:00:53.050 --> 00:00:55.690
These are basic rules that will help get you set up and

00:00:55.690 --> 00:00:57.190
your storage system up and running.

00:00:57.610 --> 00:01:01.070
They're free to download and use but it doesn't have

00:01:01.080 --> 00:01:05.019
everything that snort provides, especially the subscribers.

00:01:05.050 --> 00:01:09.480
Now you can register for anoint code which you saw me put in to

00:01:09.480 --> 00:01:12.250
my configuration file in the previous demo,

00:01:12.260 --> 00:01:15.240
registered users under the free tier,

00:01:15.250 --> 00:01:20.250
receive all of the typical snort subscriber rule set rules however,

00:01:20.260 --> 00:01:22.450
they receive them on a delayed basis.

00:01:22.490 --> 00:01:24.690
It's 30 days after the subscribers.

00:01:24.700 --> 00:01:27.740
So if you care about having your rules updated in real time,

00:01:28.320 --> 00:01:30.400
then a subscription could be beneficial for you.

00:01:31.330 --> 00:01:34.200
There's a couple different tiers of subscription for snort.

00:01:34.200 --> 00:01:36.430
If you are going to go ahead and go that route and

00:01:36.430 --> 00:01:38.450
get those updates in real time.

00:01:38.460 --> 00:01:40.200
There's a personal subscription.

00:01:40.210 --> 00:01:43.270
There's a business one and then there's an integrator one as well.

00:01:44.220 --> 00:01:48.250
Now one thing that's really cool is that not only can you use a

00:01:48.250 --> 00:01:51.120
tool like pulled pork to download the rule sets,

00:01:51.120 --> 00:01:53.680
but you can also go check them out on the snort.

00:01:53.680 --> 00:01:57.420
website of course you have to log in so you can actually

00:01:57.420 --> 00:02:00.090
see the tier that you're supposed to see.

00:02:00.100 --> 00:02:04.430
So if I was signed in right now we would see the registered to your light up

00:02:04.430 --> 00:02:07.340
as well which let me go ahead and sign in and show you.

00:02:08.460 --> 00:02:11.690
And if I go back to downloads and the rules,

00:02:11.700 --> 00:02:15.240
you see how the registered tier is available for me now.

00:02:17.220 --> 00:02:21.910
So these come into tar dot GZ file and you can just go ahead and download

00:02:21.920 --> 00:02:24.870
them and then you can unzip them and view the rules.

00:02:25.420 --> 00:02:29.610
You can also look at the latest talus advisories as well straight from here,

00:02:29.620 --> 00:02:33.370
so that's really cool that we can go here and check this stuff out

00:02:34.840 --> 00:02:37.910
now with pulled pork to update these rule sets,

00:02:37.920 --> 00:02:40.890
all we have to do is edit that configuration file,

00:02:42.120 --> 00:02:48.150
we can go ahead and change for example are registered one back to false and

00:02:48.160 --> 00:02:52.260
download the community rule set instead and we can also go ahead and add on

00:02:52.260 --> 00:02:55.330
the emerging threats Block list and here too.

00:02:55.340 --> 00:02:57.400
If you wanted to add additional block list,

00:02:57.400 --> 00:03:03.520
you can by modifying this block list URL block once you

00:03:03.520 --> 00:03:05.060
change your configuration around,

00:03:05.210 --> 00:03:10.040
just go ahead and save it and then you can rerun the pulled pork process.

00:03:11.430 --> 00:03:14.480
Now you can also set this to run on a Cron job,

00:03:14.990 --> 00:03:17.750
you know on a daily or nightly basis to help out with that.

00:03:18.360 --> 00:03:20.840
And then if we go ahead and look at the block list again,

00:03:21.810 --> 00:03:26.310
we could see after we scrolled down that we have are emerging

00:03:26.310 --> 00:03:30.480
threats blacklist now that was added or appended to the end

00:03:30.480 --> 00:03:32.140
of the block list that we had.

00:03:32.960 --> 00:03:36.270
That's because the other block list was still enabled.

00:03:36.880 --> 00:03:38.570
Let's go ahead and disable that one.

00:03:38.580 --> 00:03:41.200
Just the regular snort block list and see how the behavior is.

00:03:42.130 --> 00:03:46.320
We'll run the command again and as you can see only the

00:03:46.320 --> 00:03:48.080
emerging threat block list is here.

00:03:48.120 --> 00:03:52.100
So pulled pork essentially overrides those files or updates

00:03:52.100 --> 00:03:56.410
them so that only what you have in the configuration file is

00:03:56.410 --> 00:03:58.070
downloaded and applied to snort.

00:03:59.190 --> 00:04:02.300
So the blacklist files and the rules files are all

00:04:02.310 --> 00:04:04.770
updated after you rerun pulled pork.

00:04:04.780 --> 00:04:06.700
Once you change those configuration files,

00:04:06.730 --> 00:04:11.350
so this is super easy to use to manage your rules.

00:04:11.480 --> 00:04:14.690
And if you're only using snort in the cli you can go in and edit

00:04:14.690 --> 00:04:17.120
the rules themselves if you want to as well.

00:04:17.130 --> 00:04:19.649
But keep in mind that pulled pork will override them.

00:04:19.810 --> 00:04:22.019
Next time you run the command