Adding Local Rules¶
Adding local rules in Security Onion is a rather straightforward process. However, generating custom traffic to test the alert can sometimes be a challenge. Here, we will show you how to add the local rule and then use the python library scapy to trigger the alert.
/etc/nsm/rules/local.rulesusing your favorite text editor. If this is a distributed deployment, edit local.rules on your master server and it will replicate to your sensors.
Let’s add a simple rule that will alert on the detection of a string in a tcp session:
alert tcp any any -> $HOME_NET 7789 (msg: "Vote for Security Onion Toolsmith Tool of 2011!"; reference: url,http://holisticinfosec.blogspot.com/2011/12/choose-2011-toolsmith-tool-of-year.html; content: "toolsmith"; flow:to_server; nocase; classtype:misc-attack; sid:9000547; rev:1)
rule-update(this will merge
sid-msg.map, and restart processes as necessary):
If you built the rule correctly, then Snort/Suricata should be back up and running.
Testing Local Rules¶
Generate some traffic to trigger the alert. To generate traffic we are going to use the python library
scapyto craft packets with specific information to ensure we trigger the alert with the information we want:
Craft the layer 2 information. The ip addresses can be random, but I would suggest sticking to RFC1918:
ip = IP() ip.dst = "192.168.200.4" ip.src = "192.168.100.3"
Craft the layer 3 information Since we specified port 7789 in our snort rule:
tcp = TCP() tcp.dport = 7789 tcp.sport = 1234
Set the playload:
payload = "Toolsmith"
Use the / operator to compose our packet and transfer it with the send() method:
Check Sguil/Squert/Kibana for the corresponding alert.
You can see that we have an alert with the IP addresses we specified and the TCP ports we specified. If you pivot from that alert to the corresponding pcap you can verify the payload we sent.
You can learn more about snort and writing snort signatures from the Snort Manual.
Please note if you are using a ruleset that enables an IPS policy in
/etc/nsm/pulledpork/pulledpork.conf, your local rules will be disabled. To enabled them, either revert the policy by remarking the
ips_policy line (and run
rule-update), or add the policy type to the rules in local.rules.
For example, if
ips_policy was set to
security, you would add the following to each rule:
The whole rule would then look something like:
alert tcp any any -> $HOME_NET 7789 (msg: "Vote for Security Onion Toolsmith Tool of 2011!"; reference: url,http://holisticinfosec.blogspot.com/2011/12/choose-2011-toolsmith-tool-of-year.html; content: "toolsmith"; flow:to_server; nocase; sid:9000547; metadata:policy security-ips; rev:1)
These policy types can be found in