Snort rules and configuration are added to the parsers/snort directory for NetWitness Investigate and the Decoder. The Decoder supports the payload detection capabilities of Snort rules. The rules files must have the extension .rules and the configuration files must have the extension .conf. The Decoder implementation of Snort rules is centered on using the content strings defined in a Snort rule as a token. Once a token is matched, the rule header and additional rule options can be evaluated. Currently, rules that do not define any content (using content or uricontent rule options) are not supported.
The configuration files are loaded prior to loading rules.
Meta Key Usage
In version 11.3 or later, Snort parser meta key usage has been updated with a new option for the Snort parser. The new option, Snort="udm=true", uses the aligned Unified Data Model (UDM) key set. For information about UDM, see https://community.rsa.com/community/products/netwitness/rsa-content/udm.
By default the legacy key set, which contains keys that are consistent with previous releases, is used. Refer to General Options for a description of how the two key sets differ.
To use the aligned UDM key set for Snort parser meta keys:
- In the NetWitness Platform User Interface, go to ADMIN > Services.
- Select a Decoder and then click > View > Explore.
- In the left panel, select decoder > parsers > config.
- In the right panel, in parser.options, add Snort="udm=true".
The following image shows an example of adding Snort="udm=true".
Snort rules are parsed and loaded when PCS is loaded (any import or capture in Investigate, initial capture start and parser reload in a Decoder).
- Any rule that does not properly parse is ignored.
- Any valid Snort rule should successfully parse; however, there are rule options that are not supported by Decoders which are not fully parsed.
General options for Snort rules can result in different meta keys being written, depending on whether the Snort parser is in Aligned Key mode or Legacy Key mode.
Aligned Key Mode
Legacy Key Mode
The Decoder supports the following payload rule options.