- [Narrator] Snort is an open source IDS,
or intrusion detection system.
It's one of the most widely used IDS software
both for training and use in real life settings.
You can download and install Snort free of charge.
However, there are aspects of Snort that aren't free.
If you want the latest Snort rules,
as soon as they become available,
a paid subscription is necessary.
To download Snort, click on the Downloads menu option.
You can find the latest Snort stable release right here.
Windows and Linux versions are available.
Under Sources, you can download the source code too.
Snort runs in different modes,
including Packet Sniffer, IDS,
or IPS modes.
IPS stands for intrusion prevention system.
In the Packet Sniffer mode,
Snort works passively and collects packets
without analyzing them.
In the IDS mode,
Snort continues to act passively, but it also
analyzes packets to detect suspicious activities
and send alerts.
In the IPS mode,
Snort is active.
That is, it analyzes packets, detects suspicious activities,
and takes action against them.
Therefore, Snort drops packets,
if necessary, in the IPS mode.
Snort can store its IDS and IPS logs locally as files
which is not always scalable.
The preferred way is to forward log messages
to a dedicated log server in the cloud.
A security information and event management, or SIEM,
solution like Splunk can play the role
of the centralized log server.
Snort itself doesn't offer a visualization feature either,
but a SIEM system, such as Splunk, can fill in the gap.
Another option is using a highly scalable storage
search and analytics solution, like Elasticsearch,
combined with a visualization user interface, like Kibana.
With the support of an ecosystem consisting of log servers,
data search and analytics engines, and visualization,
Snort remains a powerful network monitoring tool.
Many organizations adopt Snort
as their primary IDS and IPS solutions.