I am a relatively new Snort user with years of sys admin experience. I feel that I must be missing something, because I find Snort rules to be completely undocumented and incomprehensible. Because of this, there's no course of action that I can take based on the rule alert to address the problem.
Example: My Snort alerts include the following today: "SID 2016847: ET INFO Possible Chrome Plugin install"
Okay, Snort finds it very important to tell me that there's a Chrome Plugin install. Does that mean an existing plugin install? Or a newly downloaded install? Who knows.
I find the following Wiki on the Emerging Threats website, which is supposed to "document" what the Snort rules mean. Here's the entry for SID 2016847:
Amazingly, no documentation. Not a stitch. There's a URL embedded in the rule: http://blogs.technet.com/b/mmpc/archive/2013/05/10/browser-extension-hijacks-facebook-profiles.aspx
Okay, great. Finally someone is describing what the threat is, two levels of indirection later. While the author describes some of the symptoms of the plugin trojan, there's not a word of how to address the problem. Am I supposed to update my browser? Which ones? Which versions? What's the name of the evil extension to purge? Will purging be sufficient? Do I need to restart my computer? Should I burn my hard drive in a flaming pentagram?
I was really hoping that Snort would be helpful, and not just spit out tons of alerts that are not actionable. I'm hoping some seasoned security expert here can enlighten me on the correct way to respond to these alerts. If your answer is, "suppress every alert that you don't understand", then you are not answering the question. There should be a way for any reasonably adept computer administrator to read these alerts, figure out what they need to check or do, and address the root problem.