Forest Global Training Partners

Cyber Risks · Cisco Talos

Using Snort Subscriber Rule Set Certified Shared Object Rules

Summary: Cisco Talos explains that Snort shared object rules require stub files, which are not included in the VRT Certified rule packs but can be generated using snort. The process involves setting global variables and dynamic preprocessor and engine options in snort.conf, then running snort with the --dump-dynamic-rules option to write the stub files to a directory such as /usr/local/etc/snort/so_rules/.

Why it matters: The certified rule packs ship without the stub files needed to instantiate shared object rules, so a deployment that skips the dump step runs without those rules loaded until someone generates the stubs by hand.

Read the original at Cisco Talos ↗

Topics
Malware
Related