Snort - IPS Policy Selection
-
I have a question about the IPS Policy Selection in Snort. Am I correct in assuming that the IPS Policy Selection does not include ET (Emerging Threats) rules nor GPLv2 Community rules nor FEODO Botnet C2 IP Rules.
The reason I’m asking is that, regardless of which policy is selected, the ET rules, GPLv2 Comm Rules and the FEODO Botnet C2 rules, can all still be manually enabled.
Whereas the columns for Snort Text Rules and Snort SO Rules become greyed out when activating the policy option.Can someone confirm if my understanding is correct? Thank you!
-
@Enso_: you are correct. Only the Snort VRT ruleset contains the proper metadata keywords for implementing an IPS Policy.
IPS Policy logic in the Snort package reads the policy metadata provided in the Snort VRT rules and uses that data to automatically select rules that have metadata tags matching the chosen IPS policy. Neither ET rules nor any other vendor ruleset contain IP policy metadata, therefore they can't be automatically screened and selected. That's why those rules remain "selectable" in the GUI but Snort VRT rules do not, when IPS Policy action is enabled.
