[Autogenerated] All right.
It's time to go explore this pre processor.
We'll take a look at the configurations that we have for
this and walk through the use of them.
Let's hop in.
All right, welcome back to the lab.
Now,
in this one we're going to start talking about those pre
processors and in this demo specifically we're gonna start
with the http inspect pre processor.
Now, if you're using a standard snort installation,
the path to see the inspection capabilities is in the
snort dot lua file in the user local etc.
Snort directory.
Alright,
so here's our snort C++ configuration as you can see many of them can be
used with defaults without any explicit configuration and we should be
using this as a template for our configuration.
What's cool is it breaks down each section at the top so you
know where to navigate to to be able to either change or see the
different configuration parameters.
So our defaults as you can see here in the snort dot lua file,
we have our home that's and stuff configured.
We're not worried about that.
Since we're talking about inspection and our pre
processors now in this second section,
this inspection configuration section we can control or what
inspection capabilities are used on this nor instance.
So all of these are configured with their internal default parameters.
Our TCP streams are iCmp and IP streams,
our DNS inspection and net flow inspection are email inspection.
SSH so on and so forth.
The snort underscore defaults dot lua configuration file is where a
lot of those default configurations are configured.
So the first one that we're gonna go look at is the one for the
HTTP underscore inspect which uses the default underscore HTTP
underscore inspect configuration.
So we'll go check that out in a second.
But this is where we define what pre processor uses,
what configuration file, if it's not going to use the defaults.
Alright.
If you've gone through the Pluralsight courses on snort,
you should have a good idea of the rest of the configuration file.
We have our detections in our filters and the output options as well.
And here we have our alerts dot Jason output instead of
using CSV or syslog or any of that.
All right.
So, now let's check out our snort defaults dot lua file.
Now,
this is that default file that tells us all of the external
defaults that are built in as we built the system,
as you can see our servers are defined as being on the home net.
R http ports are defined here.
So you can go in and customize these if you like our mail ports or ssh ports.
So if you're using custom ports in your environment,
you can come in here and define them.
So this defines all of our defaults since we're talking about the HTTP inspect.
Pre processor all of the http methods are defined here to help
snort process the information and here we have our default
underscore HTTP underscore inspect configuration parameters that we
identified in the snort dot lua file.
So as you can see parameters not specified here, get internal defaults.
So what we're saying is we're only going to add on this particular
parameter so if we're going to add in any parameters that either
override or add on to the internal defaults,
we would add them here like this one.
However, if not everything is just going to take the internal defaults.
Alright, cool.
So that's all we have configured for the http inspect configuration.
Keep in mind that Snort three when we're looking at the http inspect
pre processor looks for the HTTP keyword instead of specific ports
like Snort too does So the behavior is slightly different between
snort tunes north three here.
Now let's go look at our rule for using this HTTP inspect pre processor.
So I'm going to pull up my local rules file and
there's not a whole bunch in here.
Now look at this specific rule that we have configured for bad guys.
What this rule is saying is if any client on the Home net
connects to any server on the external net using http ports
and the content has bad guys in it,
then we're going to send an http alert message using
the security i P S alert policy.
So as snorts processing the data,
it's going to look for specific criteria that we define in the
conversation and alert us if that's true or not.
So in this case if we navigate to something like internet bad
guys dot com snort will give us an alert.
So let's test this out.
Let's go back to our browser and in a new tab,
let's navigate to internet Bad guys dot com Now it's only a
demonstration site and it's using just standard http,
not https.
Now,
let's go over to Kibana and see if we have anything in our
snort data that shows that we can use just a standard search
to search for the term bad guy, but it might not pull up anything.
What about HTTP We have eight hits.
Well, check out these messages in a second,
but let's hop back over to our cli and look at our snort logs and
let's grab for what that message is going to say.
Right, HTTP alert.
As you can see, we have HTTP alert here.
So now let's hop over and look at the message in
Kibana let's search for that string.
HTTP alert and that's not pulling up so we can look at the MsG field here,
the message field and see what that brings up.
So we have a filter for the message field and as you can see we have HTTP alert.
So let's add that as a filter and we only have two
hits now looking at the message, we have our addresses,
especially the destination address,
we have all that same information that we went over earlier and
then we have our message for HTTP alert here,
we have what the source address was, The poor information.
The rule I.
D.
Information.
And since this is a custom rule, that's my custom rule,
IDE that we created for it.
So that's an example of the http inspect pre processor.
It takes the conversation and looks for specific content when the messages
are tagged with HTTP Because snorts http inspect pre processors looking for
that HTTP string instead of the poor numbers.
So it knows that it's going to process that using the
http underscore inspect pre processor.
All right, let's move on to the flow ports.
Can pre processor.