[Autogenerated] now it's time to talk about the tool of the
module hold port this is one that the snort team maintains and
it's really easy to install and use.
You'll be able to do many things with it to help with that topic of
rural management and some of the struggles around it.
We're going to see it in action and demonstrate how to install
and use it properly in the coming demos.
This tool was built originally in pearl for snort too,
but it's actually written in python for snort three.
You can install it with mostly standard Python three libraries and it can be
installed and used on Windows Linux and other UNIX systems.
The configuration for this is really only in one file.
The pulled pork dot com file using this configuration file
were able to define what we want to download,
what rule sets we want to use,
which IP block lists to pull and where to store them and the nuances
around how to look for and handle snore Aside from this,
the other relevant file is the pulled pork dot python file that
has the base script for how the tool behaves.
You shouldn't have to modify that for basic usage,
here's an example of the pulled pork dot com file.
It's not the full file but some of the relevant items so that you
can see the options that are available to you.
We'll explore this in the demo of course.
But as you can see you can define which rule sets you can
download as well as which IP block lists and their locations
you use this to define the I.
P.
S.
Policy and the rule paths for the rules one cool thing about
this configuration file is that you can customize the
directories where the rules and the policy files are stored for
advanced tool usage and modification.
Here's the link to go ahead and download the pulled pork tool again.
It's the GitHub repo for it.
So you can pull the latest version and view the README and other docs included.
Let's get started working with pulled pork by installing it in
this demo we'll jump right into the lab,
download the package and get it installed and validate that it works.
All right.
And welcome back to the lab.
As I just mentioned in this one,
we're going to be talking about pulled pork and we'll
show you how to install and use it.
Now remember this helps us a lot with the rule management
piece and automates those downloads for us.
So let's start out by cloning the pulled Pork three.
Get repository.
Now there's two different versions for pulled pork.
There's the regular pulled pork and then there's pulled pork three.
Since we're using snort three,
we need to use the equivalent version for pulled pork.
So that's why we're using three.
If you're using two or below in your environment,
you can go ahead and download the standard pulled pork repository.
Alright.
Let's jump into that directory now and let's go ahead and
make a directory in the bin folder and that's where we're
gonna be placing a couple of files.
So we'll go ahead and copy our pulled pork dot pi file over to that
directory and then we'll go ahead and copy the entire contents of
the lib directory as well over to there.
Now that that's done,
we'll go ahead and modify the permissions for the pulled pork dot pi script.
Now this is gonna allow us to actually execute the file and then we'll go
ahead and make a new directory as well in the user local etc.
Directory for pulled Pork three.
And we'll go ahead and copy the contents of the repositories, etc.
Slash pulled pork dot com file over to there.
Now this comp file is our actual configuration file that will be
modifying for pulled pork to operate properly.
Alright, now that pulled pork is installed.
We can go ahead and test out the configuration parameters just to make sure
that it starts up properly and it'll run properly to do so we just have to
call that python script and then do a dash v.
At the end of the command just like that.
And there's a couple of errors as far as syntax goes.
But if we see the diagram below the logo and the information about pulled pork,
we're able to know that the program runs successfully with the
configuration now the configuration file that we have doesn't have
anything in it that's important yet.
So let's go ahead and edit that now.
All right.
Now we're in here in our configuration file for pulled pork.
And as you can see,
there's a lot of similar things in here compared to what we've seen before
in the previous demos where we saw a different rule sets,
we saw block lists, we have the ability to find the I.
P.
S.
Policy.
Just like we did in Cisco secure firewall.
We can control where the rules are stored and so on and
so forth for this particular demo.
We're just going to turn on the registered rules
that and enable a couple options.
We get to choose which rule sets in which block lists.
We actually download using pulled pork and we'll talk about the
differences between these rule sets and the next demo.
But for now to get our snort installation going with pulled pork,
I'm just going to turn on those registered rule set.
Now my point code is needed to be able to download that rule
set because it's for registered users.
Now, I don't have a subscription.
So I'm just going to download that registered rule set.
I'm also gonna go ahead and download the snort block list
instead of the emerging threats block list.
So we can demonstrate later on how we can change that.
We have a block list path that we can keep there.
We can define our snort path.
The pit path for the snort pit as well.
So let's go ahead and comment that and that should be it.
So let's go ahead and save that file and exit and now we need to run
it so we can run this in a similar way as before.
Using that pulled pork dot hi file and then we can do a dash C
to designate where the configuration file is.
So that configuration file is where in the user local etc.
And then pulled Pork three directory.
Now,
once you enter as you designate the configuration file
that you're gonna use pulled pork with,
it should go through properly and as you can see mine
didn't because I forgot the Sudo command.
So your Linux permissions still apply here.
But as you saw just now pulled pork sent a command
to snort to restart its process.
It wrote rules to the pulled pork rules directory.
It wrote the block list to its block list directory that we
had to find in that configuration file.
So we can actually check those out as well.
So looking at this pulled pork rules,
you can see we actually have information about the rules up at the
top and we have all of the rule sets down below.
We see when the rule sets were last updated and where any plugins that we
have are located as well and scrolling through here.
There's a lot of rules.
We're obviously not going to go through and identify each one of these
because there's a whole bunch but we can download these from the Snort
website so you can look through them at your leisure.
Or you can use a tool like Cisco secure firewall or the PF sense
integration to visualize them better in a GUI Now the same concept
is gonna be here for the list as well.
We use pulled pork to download the snort block list and as you can see we see
again when the file was updated what the block list directory is and then we
actually see the source URL for the block list.
So this is our threat intelligence download and we actually have all the I.
P.
Addresses that snort recommends blocking.
Alright.
And now that we have snore actually running with these pulled pork rules,
it's time to talk about the differences between the rule sets and
how we can change them using this awesome tool.
So join me in the next demo