[Autogenerated] Yeah.
So first up is the HTTP inspect pre processor.
This pre processor is a really useful one that helps us understand
all of the http and https traffic that snort sees.
This inspector is crucial to snorts functionality around detecting
potentially malicious traffic from these streams.
This inspector is able to detect many pieces of the
HTTP message including headers, trailers and the request line.
Each of these sections allows you to see and understand a
different part of the conversation.
For example, this can detect the U.
R.
I.
Or uniform resource indicator from the information within the packets.
This is helpful to snort operations not only because it
increases the visibility but because it allows you to write
rules specifically for this data.
As an example,
this pre processor helps to normalize the header fields as well
except for the TCP ports when it comes to the U.
R.
I.
There are four different types that it can detect and can dissect
them to provide information like the ports,
the scheme, the host and the query using this.
You can alert on a few sections of the HTTP message.
You can do things like control the amount of bytes that
are red and processed from the bodies, customize how you decode the U.
R.
I and use javascript for detection and normalization.
There's many rules that are available to make use of this H G D p pre processor.
If you want to explore them, check out did 1 19 and explore some of these rules.
Here's a few examples of them.
1 19.
Kotlin 19 is analyzing the http header for a length that exceeds 40 96.
bytes 1 1933 detects when the U.
R.
I may be malformed due to a space that's not encoded properly in it.
And another example here is when an inspect header is sent
without an actual message body attached.
All of these make use of this pre processors analysis of the data and
its ability to dissect those sections take a look at the options for
the http inspect pre processor using the differences between the
balance security and connectivity default policy and the connectivity
over security default policy.
The differences aren't a lot,
but the one that favors connectivity over security turns
off two of the inspection plugins for it.
Both of them have the same request and response depth settings
though this connectivity over security one won't unzip or
decompress the files seen before inspecting them and they won't
normalize the utF eight sequences in the U.
R.
I.
This will reduce your visibility a little bit After seeing
these differences in the configurations,
we can determine that the pre processors are used in
different ways based on the policies.
This means that you have extremely granular control over how snort functions,
understanding this tuning and rule management become
critical pieces of the snort workflow.
Also,
we have to be conscious of the use cases so that we can configure the pre
processors in rules to ensure that they're successful