• Inspectors—The inspectors examine specific types of traffic, such as FTP, for protocol anomalies.

• Binders—The Binder inspector determines when a service inspector needs to be used to inspect traffic. The configurations in the binder inspector include the ports, hosts, CIDRs, and services that define when another inspector in the network analysis policy needs to inspect traffic.

• Use the following to control the view in the JSON editor:

  • Use the Filter edit box to do a full-text search of the JSON file.

  • Click the Expand All Fields button () to open all of the folders in the JSON file.

  • Click the Collapse All Fields () button to close all folders in the JSON file.

  • Click the Undo Last Action () button to reverse your most recent change.

  • Click the Redo () button to redo your last reversed change.

  • Select Tree to see a formatted view of the JSON file, which includes action menus, error flags, and other features to guide your edits.

  • Select Code to see the raw JSON file.

• In Tree view, click the Menu () button to manipulate the contents of the file. You can:

  • Insert attributes. Use Auto to have the editor determine the appropriate data type. Otherwise, add an Array, Object, or String. If you add an invalid attribute, the system will mark the inspector or binder as having a problem that you must resolve.

  • Append attributes. This action does the same as Insert, but puts the attribute at the end of the section.

  • Duplicate the selected attribute.

  • Remove (delete) the selected attribute. When editing an attribute, a popup message might also provide a Delete command.

• To enable an inspector that is currently disabled, or change the setting of any Boolean attribute, click the checkbox in front of the attribute value. For example, to enable an inspector, change the enabled : false attribute to:

  
  

  

  
  

• To change the value of a string or numeric attribute, click in the attribute and edit the value as needed. If your entry violates the rules for the field, error messages explain the discrepancy. For example, a numeric value indicates the valid range of values if you enter a value outside the range.

• To reset overrides:

  • Click Reset Inspector/Binder Overrides to remove all of your changes to all inspectors or binders and return to default values. The deletion is limited to inspectors or binders, as indicated in the command name. For example, deleting all binder overrides leaves your inspector overrides unchanged.

  • Click Reset Inspector to Defaults to reverse all changes to the selected inspector only.

• To filter the view so you see only those inspectors that have overrides, click Show Only Overrides. Click Show All Inspectors to remove the filter.

• If an inspector is no longer supported, the inspector is flagged with a message. Click the Delete Inspector link in the message to remove the inspector.

• To download the schema for the currently-select NAP, click the gear icon () and select Download > Policy Schema.

• To download the saved set of overrides, as they existed prior to the current editing session, click the gear icon () and select Download > Last Saved Overrides. The file includes overridden attributes plus their containing objects.

• To download the overrides you have created in the current editing session, click the gear icon () and select Download > Current Unsaved Overrides. The file includes overridden attributes plus their containing objects.

You can either download the last saved overrides (those made before the current editing session) or the current unsaved overrides (those made during the current editing session).

• To create a new policy, click +.

• To edit an existing policy, click the edit icon () for the policy. When you are shown the policy details, click the Edit link in the policy properties section at the top of the page.

• Prevention—Intrusion rule actions are always applied. Connections that match a drop rule are blocked.

• Detection—Intrusion rules generate alerts only. A connection that matches a drop rule will generate alert messages, but the connection will not be blocked.

The base templates are provided by Cisco Talos. Click the info icon for each to see more information about the policies. Note that policy names can change, and new policies appear, when a new rules package gets installed.

• Maximum Detection (Cisco Talos)—This policy places all emphasis on security. Network connectivity and throughput is not guaranteed and false positives are likely. This policy should only be used for high security areas and security monitors must be prepared to investigate alerts to determine their validity.

• Security Over Connectivity (Cisco Talos)—This policy places an emphasis on security, at the possible expense of network connectivity and throughput. Traffic is inspected more deeply, more rules are evaluated, and both false positives and increased latency are expected but within reason.

• Balanced Security and Connectivity (Cisco Talos)—(Default.) This policy attempts to strike the delicate balance between network connectivity and throughput and the needs of security. While not as strict as Security Over Connectivity, this policy attempts to keep users secure while being less obtrusive about normal traffic.

• Connectivity Over Security (Cisco Talos)—This policy places an emphasis on network connectivity and throughput, at the possible expense of security. Traffic is inspected less deeply, and fewer rules are evaluated.

• No Rules Active (Cisco Talos)—This policy is a basic policy that configures typical preprocessor settings but does not have any rules or built-in alerts enabled. Use this policy as a base if you want to ensure that only those policies you want to apply are enabled.

You are returned to the intrusion policy list. You can now view the new policy and adjust rule actions as needed.

The policy contains the following sections:

• Policy Name drop-down list.

  • You can easily switch to a different policy by selecting it from the drop-down list, or return to the list of policies by clicking the back button ().

  • You can delete this policy by clicking the delete icon next to the policy name ().

• General properties. This section shows the intrusion mode, base policy, and description. Click Edit to change these properties or the policy name.

• Rule Group table of contents. This list displays all the rule groups that have active rules in the policy. The groups have a hierarchy, with parent groups containing child groups that organize subsets of rules within the larger parent group. Each group is a logical collection of rules, and a given rule can appear in more than one group.

  • To add a group that currently has no active rules in the policy, click + > Add Existing Rule Group and select the group. See Adding or Removing Rule Groups in an Intrusion Policy (Snort 3).

  • To change the security level of a group, select the child group in the list. The rule list changes to show the security level at the top, with the rules in the group listed below. Click the Edit link next to the security level and select a new level. Click View Description when editing to get information about each security level. Note that changing the level can change which rules are active, and also the action for a given rule, with more secure levels tending to have more active rules and more rules with the Drop action. Click OK to confirm the change. (Security Level does not apply to custom rule groups.)

    
    

    

    
    

  • To remove all the rules in a group, select the child group in the list. Then, click the Exclude link to the far right of the group name and confirm that you want to exclude the group. Excluding the group simply disables all the rules in the group. It does not delete the group.

    However, if the group includes rules that are shared with other groups that are enabled, the shared rules retain whatever actions are applied by the still-active group. In all cases, we retain your most aggressive setting for an individual rule, regardless of group membership.

  • To add a new custom rule group of custom rules, click + > Upload Custom Rules. For details, see Uploading Custom Intrusion Rules.

  • To change the name or description of a custom rule group, click Edit.

  • To delete a custom rule group, click Delete. For more information, see Managing Custom Intrusion Rules and Rule Groups.

  • To add a new custom rule in a custom rule group, click + above the rule table. See Configuring Individual Custom Intrusion Rules.

  • To edit, duplicate, delete, or manage group membership for a custom rule, mouse over the right of the rule and click the appropriate button or command. For more information, see Configuring Individual Custom Intrusion Rules.

• List of rules. You can use the search field to help you find rules using full-text search. You can also select filtering items to search on any combination of GID or SID, show only user defined rules (those you added), show only those rules whose actions are overridden, or simply show rules based on their actions (disabled, alert, drop). The rules are lazy-loaded, so it will take quite a bit of time to scroll through the entire unfiltered list. When filtering the list, click the refresh button to reload the filtered view.

  • To change the action for a rule, click the Action cell for the rule and select the new action, to Alert only, to Block matching traffic, or to Disable the rule. The default action for each rule is indicated.

  • To change the action for more than one rule at a time, click the check box in the left column of the rules you want to change, then select the new action from the Action drop-down list above the rules table. Click the check box in the GID:SID header to select all the rules in the list. You can change up to 5000 rules at a time.

  • To update the rules within a custom rule group, click Upload Rule File. For more information, see Uploading Custom Intrusion Rules.

  • To get more information about a rule, click the link in the GID:SID cell. The link takes you to Snort.org.

  • To change the rules listed, you can click a child group from the rule group table of contents (not a parent group). You can return to the all-rules list by clicking ALL RULES at the top of the rule group list.

  • To change the sorting order, click the table header for a column. The default sorting for the rules is overridden rules first, then drop rules, then alert rules.

  • To see what changes where made in an intrusion rule (LSP) update, select LSP Update in the filter field, then select the updates whose changes you want to see, and specify whether you want to see all changes, or just additions or changes to the rules.

• Select the group, then click the Exclude link to the far right of the group name, above the list of rules.

• Use the method for adding a group, but instead, deselect the unwanted group (that is, uncheck its check box), and click OK.

• You can delete a custom rule group to remove it entirely from the system and from all intrusion policies that use it. Select the group, then click Delete.

We recommend that you add custom rules to a custom intrusion policy rather than one of the built-in policies.

• To create a group, click + > Upload Custom Rules. See Uploading Custom Intrusion Rules.

• To edit a group’s name or description, select the group in the group table of contents in the User Defined Groups folder. You can then click Edit and make your changes.

• To exclude the group and its rules from the policy, select the group in the group table of contents in the User Defined Groups folder. You can then click Exclude to remove the group.

• To delete the group from the system and all policies that use it, select the group in the group table of contents in the User Defined Groups folder. Then click Delete. Note that if a rule exists only in the deleted group, it is also deleted from the system. However, if a rule also exists in other custom rule groups that you are not deleting, the rule will remain in those groups.

• To replace or update the rules in a group in bulk, select the group in the group table of contents in the User Defined Groups folder. Then, click Upload Rule File next to the Action drop-down list above the group’s rule table. The process is the same as that described in Uploading Custom Intrusion Rules.

• To create and manage individual rules, and their assignment to rule groups, see Configuring Individual Custom Intrusion Rules.