How can an admin choose which Snort rules to enable?

Question

The purpose is to configure Snort as an IDS to monitor network activity, and alert against the standard set of things an IDS should alert against--> buffer overflow attacks, injection attacks, port scans & information leaks to name a few, or in general, the attempts to detect/exploit vulnerabilities, leak confidential data and evade policies.

How is a network admin suppose to decide that what Snort rules he should enable for his network?

How does one shortlist on the .rules files to be used and the rules (in them) to be enabled?

Answer 1

You just asked the most decisive question that has huge impact on detection. It is a tedious (rather very interesting) and ongoing full time job to best fine tune IDS, especially in large networks.

General rules

• Very important. Know your environment very well! There is no excuse this requirement. You have to know what you are protecting, network ranges, application, how the application run , and are developed on - including web server types (iis, apache etc.), operating systems (Linux, windows, Cisco stuff etc.), technology (asp, php, java etc.), other products (erp, databases etc.), and most importantly what type of data (ssn, bank info, PII etc.).
• Study and compile a list of all the above information, and appropriate network segments they reside in. It will give you a clear map of what signatures you really need, if all your web servers are running IIS with ASP .net then there is no need of php signatures. If you are a bank then you want most data leak signatures turned on, You will have to make this categorization and sorting of types of rules you need.
• Leave the standard signatures like port scan, malicious activity, major worm/viruses etc. active on IDS, they always help.
• Improve and update the list regularly, track changes in the environment, new added software/application to upto date signature list, and then select any new signature updates.