Single User -OpenAPPI Rules
-
As a single user configuring Snort, I'm starting to see no reason to enable OpenAPPI rules. So far, it's only alerted me when I'm using an application that I already know I'm using, or accessing a site that I already know I want to.
I was hoping it would alert me if some rogue application attempted to do something nefarious. I've seen nothing of the sort. Is this feature simply for teams to monitor certain generic browsing? As a single user (and maybe a girlfriend or two), should I disable Snort OPENAPPI rules? Thanks!
-
See my reply to you similar question here. To repeat the answer from there, "no, there is really no need to use the OpenAppID rules in a home network".
As you surmised, those rules are primarily aimed at identifying various traffic types and are not designed to detect and stop malicious software. Mostly they are to help IT Security admins enforce corporate computing policies such as no or limited access to social media during work hours and other similar policies.
