What is the difference between the two detectors
-
what is the difference between snort openappid detectors and snort openappid rules detectors ?
-
I don't think there is a difference ones enable openappid and the other enable downloading the rules
-
Two things are necessary for OpenAppID to function. First, the OpenAppID preprocessor must be enabled within the Snort binary. That happens when you check the OpenAppID Detector box on the PREPROCESSORS tab. The second thing that has to happen is the preprocessor you just enabled needs some rules to know what apps to look for. Those get downloaded from a third-party repository (currently hosted in Brazil I believe). You enable the OpenAppID rules download on the GLOBAL SETTINGS tab.
The Snort VRT folks don't publish their own set of OpenAppID rules. You either have to write your own or find a third-party site. A contributor volunteered last year to provide a package of common OpenAppID rules and to host them on a University web site. That's the Brazil site (if I am remembering the location correctly). The URL is hard-coded in the GUI code and was provided by the contributor.
Bill
