I just started using Snort. There is a lot to it. I'm just looking for better documentation of what some of the Snort rules actually mean -- i.e. How I should react to them when I have an alert for a given rule pop up. It seems that the Snort docs, examples, and forums assume a lot of esoteric network security administrator background knowledge that I appear not to have (yet).
For example, I found this:
However that section of the Snort website is woefully out of date and the search part doesn't work, and 404's pop up when I manually input many of the rule ids I'm interested in.
Example, for the stream5 preprocessor:
- https://www.snort.org/rule-docs/129-1 <-- This works
- https://www.snort.org/rule-docs/129-12 <-- This is 404
The second one, "129:12", has a text description of "Consecutive TCP small segments exceeding threshold". What does that even mean? In what way is that indicative of a problem? I examined our network, and there's only acceptable network activity (that I could tell). During an event where Snort was very verbose about this particular problem (on the order of 100 messages per minute), the problem was traced to authorized traffic passing out through our squid proxy.
So what, should I just suppress all of these messages? Is that a normal way to tune Snort? Just suppress the noise? That strikes me as crazy... If I suppress all these messages, what if there are messages of this class that actually indicate a problem?
I hope you get the idea.
Currently I am using pulledpork to assemble rulesets, and suppressing noisy rules via suppress directives in threshold.conf.
Lastly, I should mention that I'm running Snort in a fairly non-conventional way, as a workaround to satisfy IDS requirements for PCI, while running in the AWS cloud. Long story short, we have Snort running on all boxes that we classify as "edge" boxes, and are sniffing traffic on those. I'll provide more detail if requested, but that doesn't change the basic gist of this question.