Resources

Informational and instructional videos, labs, and documents for Snort 3 and Snort 2.

Details

For Ep. #9 of ThreatWise TV, Hazel Burton talks to some of our Snort engineers to look at a variety of ways Snort can be utilized to protect organizations. We also analyze Snort data gathered by Cisco Secure Firewall and talk about the vulnerabilities and exploits that attackers targeted most often.

Snort Overview

ThreatWise TV: How Snort works Snort 101

Snort 3

Snort 3 - Install and Config (with labs) Snort 3 - Writing Rules (with labs) Snort 3 - Logging (with labs)

Miscellaneous

Snort 3 - Roundtable Discussion

Snort 2

Snort 2 - Install and Config (with labs) Snort 2 - Introduction to Rule Writing

Documents

White Papers

VRT Methodology: Focusing on Protecting "Your" Network 2011
Inline Normalization with Snort 2.9.0 2010
Using Perfmon and Performance Profiling to Tune Snort Preprocessors and Rules 2009
Target-Based TCP Timestamp Stream Reassembly (with introduction to timestamps) 2007
Target-Based Fragmentation Reassembly 2005
HTTPS IDS Evasions Revisited 2004
Performance Rules Creation/VRT Rules Methodology, Snort Architecture (Preprocessors, Detection Methodology) 2003
Optimizing Pattern Matching for Intrusion Detection 2002
Performance Rules Creation Part 2, Rule Options and Techniques 2002

Open AppID

OpenAppID: Open Source Community Webinar 2015
OpenAppID: Development Manager Costas Kleopa, Open Source Community Webinar

Multimedia Snort How-To's

Snort Installation and Configuration
Basics of Snort Rule Writing (Snort2)
Snort Installation, Configuration, and Basic Usage
How to Create Useful False Positive Reports
Performance Tuning Snort
Using the Host Attribute Table Feature in Snort
Open Source Community Webinar 2013
Using MultiConfig 2011
Snort Tuning 101 2011

Troubleshooting

Possible Packet Loss During Reassembly 2015

Other Resources