[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AE5VNT2QTNSJK7YQX3FN5M":3,"skill-same:01M6AE5VNT2QTNSJK7YQX3FN5M":156},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":31,"publishedAt":47,"linkOnly":48,"markdownContent":49,"markdownBody":50,"frontMatter":51,"refName":67,"commitSha":68,"skillDirectory":69,"forksCount":70,"repositoryHtmlUrl":71,"repositoryHomepageUrl":72,"ownerHtmlUrl":73,"ownerBlogUrl":74,"ownerDescription":75,"updatedAt":76,"install":77,"resources":90},"01M6AE5VNT2QTNSJK7YQX3FN5M","configuring-snort-ids-for-intrusion-detection",null,"Installs, configures, and tunes Snort 3 to monitor network traffic for malicious activity using custom and community rulesets, preprocessors, and alert output plugins. Use when deploying network-based intrusion detection at key boundaries, writing custom Snort rules, tuning rulesets to reduce false positives, or integrating Snort alerts with a SIEM.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconfiguring-snort-ids-for-intrusion-detection\u002FSKILL.md",[18,23,26],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":27,"categoryName":28,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000036","内容创作者","PROFESSION","适用职业",[32,33,34,35,36,37,38,39,40,41,42,43,44,45,46],"configuring snort ids for intrusion detection","writing","malicious","security","cybersecurity","siem","pr","monitor","plugins","intrusion-detection","network","network-security","snort","ids","rule-writing","2026-11-10 10:12:30",false,"---\nname: configuring-snort-ids-for-intrusion-detection\ndescription: 'Installs, configures, and tunes Snort 3 to monitor network traffic\n  for malicious activity using custom and community rulesets, preprocessors, and\n  alert output plugins. Use when deploying network-based intrusion detection at\n  key boundaries, writing custom Snort rules, tuning rulesets to reduce false positives,\n  or integrating Snort alerts with a SIEM.\n\n  '\ndomain: cybersecurity\nsubdomain: network-security\ntags:\n- network-security\n- snort\n- ids\n- intrusion-detection\n- rule-writing\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.IR-01\n- DE.CM-01\n- ID.AM-03\n- PR.DS-02\nmitre_attack:\n- T1046\n- T1071.001\n- T1572\n- T1210\n- T1048\n---\n# Configuring Snort IDS for Intrusion Detection\n\n## When to Use\n\n- Deploying a network-based intrusion detection system to monitor traffic at key network boundaries\n- Writing custom Snort rules to detect organization-specific threats, attack patterns, or policy violations\n- Tuning existing rulesets to reduce false positives while maintaining detection coverage\n- Integrating Snort alerts with SIEM platforms for centralized security monitoring\n- Validating network security controls by generating test traffic and confirming detection\n\n**Do not use** as a replacement for endpoint detection, for monitoring encrypted traffic without TLS inspection, or as the sole security control without complementary defenses.\n\n## Prerequisites\n\n- Snort 3.x installed from source or package manager (`snort --version` to verify)\n- Network interface configured for promiscuous mode on a span port or network tap\n- DAQ (Data Acquisition Library) installed for packet capture integration\n- Registered Snort account for downloading Snort Subscriber (paid) or Community rulesets from snort.org\n- PulledPork 3 or similar rule management tool for automated ruleset updates\n- Sufficient CPU and memory for inline traffic inspection at line rate\n\n## Workflow\n\n### Step 1: Install and Verify Snort 3\n\n```bash\n# Install dependencies (Ubuntu\u002FDebian)\nsudo apt install -y build-essential libpcap-dev libpcre3-dev libnet1-dev \\\n  zlib1g-dev luajit hwloc libdumbnet-dev bison flex libcmocka-dev \\\n  libnetfilter-queue-dev libmnl-dev autotools-dev libluajit-5.1-dev \\\n  pkg-config cmake libhwloc-dev liblzma-dev openssl libssl-dev cpputest \\\n  libsqlite3-dev uuid-dev\n\n# Install DAQ from source\ngit clone https:\u002F\u002Fgithub.com\u002Fsnort3\u002Flibdaq.git\ncd libdaq && .\u002Fbootstrap && .\u002Fconfigure && make && sudo make install\n\n# Install Snort 3\ngit clone https:\u002F\u002Fgithub.com\u002Fsnort3\u002Fsnort3.git\ncd snort3 && .\u002Fconfigure_cmake.sh --prefix=\u002Fusr\u002Flocal\ncd build && make -j$(nproc) && sudo make install\nsudo ldconfig\n\n# Verify installation\nsnort -V\n```\n\n### Step 2: Configure Network Interfaces\n\n```bash\n# Disable offloading features that interfere with packet inspection\nsudo ethtool -K eth1 gro off lro off tso off gso off rx off tx off\n\n# Enable promiscuous mode\nsudo ip link set eth1 promisc on\n\n# Create systemd service for persistent interface configuration\nsudo tee \u002Fetc\u002Fsystemd\u002Fsystem\u002Fsnort-iface.service \u003C\u003C 'EOF'\n[Unit]\nDescription=Configure Snort capture interface\nBefore=snort.service\n\n[Service]\nType=oneshot\nExecStart=\u002Fsbin\u002Fethtool -K eth1 gro off lro off tso off gso off rx off tx off\nExecStart=\u002Fsbin\u002Fip link set eth1 promisc on\nRemainAfterExit=yes\n\n[Install]\nWantedBy=multi-user.target\nEOF\n\nsudo systemctl enable snort-iface.service\n```\n\n### Step 3: Configure Snort 3 with Lua Configuration\n\n```bash\n# Create Snort directory structure\nsudo mkdir -p \u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002F{rules,builtin_rules,lists,appid}\nsudo mkdir -p \u002Fvar\u002Flog\u002Fsnort\n\n# Edit the main Snort configuration\nsudo tee \u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002Fsnort.lua \u003C\u003C 'LUAEOF'\n-- Snort 3 Configuration\n\n-- Network variables\nHOME_NET = '10.10.0.0\u002F16'\nEXTERNAL_NET = '!$HOME_NET'\n\n-- Path variables\nRULE_PATH = '\u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002Frules'\nBUILTIN_RULE_PATH = '\u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002Fbuiltin_rules'\n\n-- Configure DAQ\ndaq = {\n    module_dirs = { '\u002Fusr\u002Flocal\u002Flib\u002Fdaq' },\n    modules = { { name = 'afpacket', variables = { 'buffer_size_mb=256' } } }\n}\n\n-- Decoder configuration\nnormalizer = { tcp = { ips = true } }\n\n-- Stream inspection\nstream = { }\nstream_tcp = { policy = 'linux', session_timeout = 180 }\nstream_udp = { session_timeout = 30 }\nstream_icmp = { }\n\n-- HTTP inspection\nhttp_inspect = { }\n\n-- DNS inspection\ndns = { }\n\n-- SSL\u002FTLS inspection\nssl = { }\n\n-- SMB inspection\ndce_smb = { }\n\n-- File identification and processing\nfile_id = { rules_file = '\u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002Ffile_magic.rules' }\n\n-- Port scan detection\nport_scan = {\n    protos = 'all',\n    scan_types = 'all',\n    memcap = 10000000\n}\n\n-- Reputation-based filtering\n-- reputation = {\n--     blacklist = RULE_PATH .. '\u002Fblocklist.rules'\n-- }\n\n-- IPS rules\nips = {\n    enable_builtin_rules = true,\n    include = RULE_PATH .. '\u002Fsnort3-community.rules',\n    variables = {\n        nets = { HOME_NET = HOME_NET, EXTERNAL_NET = EXTERNAL_NET },\n        ports = {\n            HTTP_PORTS = '80 8080 8443',\n            SSH_PORTS = '22',\n            DNS_PORTS = '53'\n        }\n    }\n}\n\n-- Alert output\nalert_fast = {\n    file = true,\n    packet = false,\n    limit = 100\n}\n\n-- Unified2 output for Barnyard2\u002FSIEM integration\n-- alert_unified2 = { limit = 128 }\n\n-- JSON alert output\nalert_json = {\n    file = true,\n    limit = 100,\n    fields = 'timestamp pkt_num proto pkt_gen pkt_len dir src_addr src_port dst_addr dst_port service rule action'\n}\n\n-- Syslog output\n-- alert_syslog = { level = 'info', facility = 'local1' }\n\nLUAEOF\n```\n\n### Step 4: Download and Configure Rulesets\n\n```bash\n# Download Snort 3 Community Rules\nwget https:\u002F\u002Fwww.snort.org\u002Fdownloads\u002Fcommunity\u002Fsnort3-community-rules.tar.gz\ntar xzf snort3-community-rules.tar.gz\nsudo cp snort3-community-rules\u002Fsnort3-community.rules \u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002Frules\u002F\n\n# Install PulledPork 3 for automated rule management\ngit clone https:\u002F\u002Fgithub.com\u002Fshirkdog\u002Fpulledpork3.git\ncd pulledpork3\nsudo python3 setup.py install\n\n# Configure PulledPork\nsudo tee \u002Fusr\u002Flocal\u002Fetc\u002Fpulledpork3\u002Fpulledpork.conf \u003C\u003C 'EOF'\nregistered_ruleset = true\noinkcode = \u003CYOUR_OINK_CODE>\nsnort_path = \u002Fusr\u002Flocal\u002Fbin\u002Fsnort\nlocal_rules = \u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002Frules\u002Flocal.rules\nsorule_path = \u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002Fso_rules\u002F\nsnort_version = 3.0.0.0\nblocklist_path = \u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002Flists\u002F\npid_path = \u002Fvar\u002Frun\u002Fsnort.pid\nips_policy = balanced\nEOF\n\n# Run PulledPork to fetch and process rules\nsudo pulledpork3 -c \u002Fusr\u002Flocal\u002Fetc\u002Fpulledpork3\u002Fpulledpork.conf\n```\n\n### Step 5: Write Custom Detection Rules\n\n```bash\n# Create local rules file\nsudo tee \u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002Frules\u002Flocal.rules \u003C\u003C 'EOF'\n# Detect reverse shell on common ports\nalert tcp $HOME_NET any -> $EXTERNAL_NET 4444 (\n    msg:\"LOCAL Possible Reverse Shell on port 4444\";\n    flow:established,to_server;\n    content:\"\u002Fbin\u002Fsh\"; nocase;\n    sid:1000001; rev:1;\n    classtype:trojan-activity;\n    priority:1;\n)\n\n# Detect Mimikatz execution indicators over SMB\nalert tcp any any -> $HOME_NET 445 (\n    msg:\"LOCAL Mimikatz Lateral Movement via SMB\";\n    flow:established,to_server;\n    content:\"|FF|SMB\";\n    content:\"mimikatz\"; nocase; distance:0;\n    sid:1000002; rev:1;\n    classtype:trojan-activity;\n    priority:1;\n)\n\n# Detect DNS tunneling (high-entropy long subdomain queries)\nalert udp $HOME_NET any -> any 53 (\n    msg:\"LOCAL Possible DNS Tunneling - Long Query Name\";\n    content:\"|01 00|\"; offset:2; depth:2;\n    byte_test:1,>,50,12;\n    sid:1000003; rev:1;\n    classtype:policy-violation;\n    priority:2;\n)\n\n# Detect cleartext password transmission via FTP\nalert tcp $HOME_NET any -> any 21 (\n    msg:\"LOCAL FTP Cleartext Password Detected\";\n    flow:established,to_server;\n    content:\"PASS \"; depth:5;\n    sid:1000004; rev:1;\n    classtype:policy-violation;\n    priority:2;\n)\n\n# Detect potential port scan (SYN flood pattern)\nalert tcp $EXTERNAL_NET any -> $HOME_NET any (\n    msg:\"LOCAL Possible Port Scan SYN Flood\";\n    flow:stateless;\n    flags:S,12;\n    threshold:type both, track by_src, count 100, seconds 10;\n    sid:1000005; rev:1;\n    classtype:attempted-recon;\n    priority:2;\n)\nEOF\n```\n\n### Step 6: Validate Configuration and Run\n\n```bash\n# Validate configuration\nsnort -c \u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002Fsnort.lua --daq-dir \u002Fusr\u002Flocal\u002Flib\u002Fdaq -T\n\n# Run Snort in IDS mode on the capture interface\nsudo snort -c \u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002Fsnort.lua --daq-dir \u002Fusr\u002Flocal\u002Flib\u002Fdaq \\\n  -i eth1 -l \u002Fvar\u002Flog\u002Fsnort -D\n\n# Test rules against a PCAP file\nsnort -c \u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002Fsnort.lua --daq-dir \u002Fusr\u002Flocal\u002Flib\u002Fdaq \\\n  -r test_traffic.pcap -l \u002Fvar\u002Flog\u002Fsnort\u002Ftest\u002F -A fast\n\n# Create systemd service for production deployment\nsudo tee \u002Fetc\u002Fsystemd\u002Fsystem\u002Fsnort.service \u003C\u003C 'EOF'\n[Unit]\nDescription=Snort 3 IDS\nAfter=network.target snort-iface.service\n\n[Service]\nType=simple\nExecStart=\u002Fusr\u002Flocal\u002Fbin\u002Fsnort -c \u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002Fsnort.lua --daq-dir \u002Fusr\u002Flocal\u002Flib\u002Fdaq -i eth1 -l \u002Fvar\u002Flog\u002Fsnort -D\nExecReload=\u002Fbin\u002Fkill -SIGHUP $MAINPID\nRestart=on-failure\n\n[Install]\nWantedBy=multi-user.target\nEOF\n\nsudo systemctl enable --now snort.service\n```\n\n### Step 7: Monitor Alerts and Tune Rules\n\n```bash\n# View real-time alerts\ntail -f \u002Fvar\u002Flog\u002Fsnort\u002Falert_fast.txt\n\n# Parse JSON alerts for analysis\ncat \u002Fvar\u002Flog\u002Fsnort\u002Falert_json.txt | python3 -m json.tool\n\n# Identify top triggered rules for tuning\ngrep -oP 'sid:\\d+' \u002Fvar\u002Flog\u002Fsnort\u002Falert_fast.txt | sort | uniq -c | sort -rn | head -20\n\n# Suppress noisy false-positive rules\nsudo tee -a \u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002Frules\u002Fsuppress.rules \u003C\u003C 'EOF'\nsuppress gen_id 1, sig_id 2100498, track by_src, ip 10.10.1.100\nsuppress gen_id 1, sig_id 2100366, track by_dst, ip 10.10.5.0\u002F24\nEOF\n\n# Verify rule count and performance\nsnort -c \u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002Fsnort.lua --daq-dir \u002Fusr\u002Flocal\u002Flib\u002Fdaq -T 2>&1 | grep -i \"rules loaded\"\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **IDS vs IPS** | IDS passively monitors traffic and generates alerts; IPS sits inline and can actively block or drop malicious packets in real time |\n| **Snort Rule** | Detection signature with header (action, protocol, src\u002Fdst, ports) and options (content matches, flow direction, metadata) that triggers on matching traffic |\n| **Preprocessor** | Snort component that normalizes and reassembles protocol-specific traffic before rule inspection, handling fragmentation, stream reassembly, and protocol anomalies |\n| **DAQ (Data Acquisition)** | Abstraction layer in Snort 3 that interfaces with packet capture mechanisms (AF_PACKET, PCAP, NFQ) for receiving network data |\n| **Oink Code** | Personal registration code from snort.org required to download Snort Subscriber or Registered rulesets |\n| **Threshold\u002FSuppression** | Tuning mechanisms that control alert frequency (threshold) or completely silence alerts from specific sources\u002Fdestinations (suppress) |\n\n## Tools & Systems\n\n- **Snort 3**: Open-source network intrusion detection and prevention system with Lua-based configuration and multithreaded architecture\n- **PulledPork 3**: Automated Snort rule management tool that downloads, processes, and deploys rulesets with policy-based filtering\n- **Barnyard2**: Dedicated spooler that reads Snort's unified2 binary output and writes to databases (MySQL, PostgreSQL) for SIEM integration\n- **Snorby**: Web-based Snort alert management console providing dashboards, event classification, and reporting\n- **tcpreplay**: Tool for replaying PCAP files through Snort to validate rules and test detection capabilities\n\n## Common Scenarios\n\n### Scenario: Deploying Snort IDS at a Network Perimeter for Compliance\n\n**Context**: A healthcare organization needs to deploy network IDS to meet HIPAA technical safeguard requirements. The IDS must monitor traffic between the DMZ and internal network, detect common attack patterns, and forward alerts to the existing Splunk SIEM. The network carries approximately 500 Mbps of traffic during peak hours.\n\n**Approach**:\n1. Install Snort 3 on a dedicated sensor with dual NICs -- one for monitoring (span port from core switch) and one for management\n2. Configure AF_PACKET DAQ with a 512 MB ring buffer to handle peak throughput without drops\n3. Deploy Snort Community rules plus Emerging Threats Open ruleset as baseline detection\n4. Write custom rules for organization-specific threats: detection of PHI data patterns (SSN, MRN formats) leaving the network, unauthorized access to DICOM\u002FHL7 ports, and connections to known bad IP lists\n5. Configure JSON alert output and forward to Splunk via syslog using rsyslog\n6. Run Snort against 24 hours of captured baseline traffic to identify false positives, then create suppression rules for legitimate traffic patterns\n7. Enable Snort as a systemd service with automatic restart and log rotation\n\n**Pitfalls**:\n- Deploying all available rules without tuning, overwhelming the sensor and SOC with thousands of daily false positives\n- Forgetting to disable NIC offloading, causing Snort to miss packets due to checksum errors or jumbo frames\n- Not sizing the sensor hardware for peak traffic, leading to packet drops during high-volume periods\n- Relying solely on community rules without custom rules for organization-specific threats and compliance requirements\n\n## Output Format\n\n```\n## Snort IDS Deployment Report\n\n**Sensor**: snort-sensor-01 (10.10.1.250)\n**Interface**: eth1 (span port from Core-SW1 gi0\u002F24)\n**Configuration**: \u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002Fsnort.lua\n**Ruleset**: Snort Community 3.0 + Local Rules (1,247 active rules)\n**HOME_NET**: 10.10.0.0\u002F16\n\n### Detection Summary (24-hour baseline)\n\n| Category | Alert Count | Top Rule SID |\n|----------|-------------|--------------|\n| Attempted Recon | 342 | 1:2100498 (ICMP ping) |\n| Trojan Activity | 12 | 1:1000001 (Reverse shell) |\n| Policy Violation | 87 | 1:1000004 (FTP cleartext) |\n| Web Application Attack | 23 | 1:2100654 (SQL injection) |\n\n### Tuning Actions Taken\n- Suppressed SID 2100498 for 10.10.1.100 (monitoring server legitimate ICMP)\n- Thresholded SID 1000004 to 5 alerts per source per hour\n- Added 3 custom rules for PHI exfiltration detection\n```\n","# Configuring Snort IDS for Intrusion Detection\n\n## When to Use\n\n- Deploying a network-based intrusion detection system to monitor traffic at key network boundaries\n- Writing custom Snort rules to detect organization-specific threats, attack patterns, or policy violations\n- Tuning existing rulesets to reduce false positives while maintaining detection coverage\n- Integrating Snort alerts with SIEM platforms for centralized security monitoring\n- Validating network security controls by generating test traffic and confirming detection\n\n**Do not use** as a replacement for endpoint detection, for monitoring encrypted traffic without TLS inspection, or as the sole security control without complementary defenses.\n\n## Prerequisites\n\n- Snort 3.x installed from source or package manager (`snort --version` to verify)\n- Network interface configured for promiscuous mode on a span port or network tap\n- DAQ (Data Acquisition Library) installed for packet capture integration\n- Registered Snort account for downloading Snort Subscriber (paid) or Community rulesets from snort.org\n- PulledPork 3 or similar rule management tool for automated ruleset updates\n- Sufficient CPU and memory for inline traffic inspection at line rate\n\n## Workflow\n\n### Step 1: Install and Verify Snort 3\n\n```bash\n# Install dependencies (Ubuntu\u002FDebian)\nsudo apt install -y build-essential libpcap-dev libpcre3-dev libnet1-dev \\\n  zlib1g-dev luajit hwloc libdumbnet-dev bison flex libcmocka-dev \\\n  libnetfilter-queue-dev libmnl-dev autotools-dev libluajit-5.1-dev \\\n  pkg-config cmake libhwloc-dev liblzma-dev openssl libssl-dev cpputest \\\n  libsqlite3-dev uuid-dev\n\n# Install DAQ from source\ngit clone https:\u002F\u002Fgithub.com\u002Fsnort3\u002Flibdaq.git\ncd libdaq && .\u002Fbootstrap && .\u002Fconfigure && make && sudo make install\n\n# Install Snort 3\ngit clone https:\u002F\u002Fgithub.com\u002Fsnort3\u002Fsnort3.git\ncd snort3 && .\u002Fconfigure_cmake.sh --prefix=\u002Fusr\u002Flocal\ncd build && make -j$(nproc) && sudo make install\nsudo ldconfig\n\n# Verify installation\nsnort -V\n```\n\n### Step 2: Configure Network Interfaces\n\n```bash\n# Disable offloading features that interfere with packet inspection\nsudo ethtool -K eth1 gro off lro off tso off gso off rx off tx off\n\n# Enable promiscuous mode\nsudo ip link set eth1 promisc on\n\n# Create systemd service for persistent interface configuration\nsudo tee \u002Fetc\u002Fsystemd\u002Fsystem\u002Fsnort-iface.service \u003C\u003C 'EOF'\n[Unit]\nDescription=Configure Snort capture interface\nBefore=snort.service\n\n[Service]\nType=oneshot\nExecStart=\u002Fsbin\u002Fethtool -K eth1 gro off lro off tso off gso off rx off tx off\nExecStart=\u002Fsbin\u002Fip link set eth1 promisc on\nRemainAfterExit=yes\n\n[Install]\nWantedBy=multi-user.target\nEOF\n\nsudo systemctl enable snort-iface.service\n```\n\n### Step 3: Configure Snort 3 with Lua Configuration\n\n```bash\n# Create Snort directory structure\nsudo mkdir -p \u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002F{rules,builtin_rules,lists,appid}\nsudo mkdir -p \u002Fvar\u002Flog\u002Fsnort\n\n# Edit the main Snort configuration\nsudo tee \u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002Fsnort.lua \u003C\u003C 'LUAEOF'\n-- Snort 3 Configuration\n\n-- Network variables\nHOME_NET = '10.10.0.0\u002F16'\nEXTERNAL_NET = '!$HOME_NET'\n\n-- Path variables\nRULE_PATH = '\u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002Frules'\nBUILTIN_RULE_PATH = '\u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002Fbuiltin_rules'\n\n-- Configure DAQ\ndaq = {\n    module_dirs = { '\u002Fusr\u002Flocal\u002Flib\u002Fdaq' },\n    modules = { { name = 'afpacket', variables = { 'buffer_size_mb=256' } } }\n}\n\n-- Decoder configuration\nnormalizer = { tcp = { ips = true } }\n\n-- Stream inspection\nstream = { }\nstream_tcp = { policy = 'linux', session_timeout = 180 }\nstream_udp = { session_timeout = 30 }\nstream_icmp = { }\n\n-- HTTP inspection\nhttp_inspect = { }\n\n-- DNS inspection\ndns = { }\n\n-- SSL\u002FTLS inspection\nssl = { }\n\n-- SMB inspection\ndce_smb = { }\n\n-- File identification and processing\nfile_id = { rules_file = '\u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002Ffile_magic.rules' }\n\n-- Port scan detection\nport_scan = {\n    protos = 'all',\n    scan_types = 'all',\n    memcap = 10000000\n}\n\n-- Reputation-based filtering\n-- reputation = {\n--     blacklist = RULE_PATH .. '\u002Fblocklist.rules'\n-- }\n\n-- IPS rules\nips = {\n    enable_builtin_rules = true,\n    include = RULE_PATH .. '\u002Fsnort3-community.rules',\n    variables = {\n        nets = { HOME_NET = HOME_NET, EXTERNAL_NET = EXTERNAL_NET },\n        ports = {\n            HTTP_PORTS = '80 8080 8443',\n            SSH_PORTS = '22',\n            DNS_PORTS = '53'\n        }\n    }\n}\n\n-- Alert output\nalert_fast = {\n    file = true,\n    packet = false,\n    limit = 100\n}\n\n-- Unified2 output for Barnyard2\u002FSIEM integration\n-- alert_unified2 = { limit = 128 }\n\n-- JSON alert output\nalert_json = {\n    file = true,\n    limit = 100,\n    fields = 'timestamp pkt_num proto pkt_gen pkt_len dir src_addr src_port dst_addr dst_port service rule action'\n}\n\n-- Syslog output\n-- alert_syslog = { level = 'info', facility = 'local1' }\n\nLUAEOF\n```\n\n### Step 4: Download and Configure Rulesets\n\n```bash\n# Download Snort 3 Community Rules\nwget https:\u002F\u002Fwww.snort.org\u002Fdownloads\u002Fcommunity\u002Fsnort3-community-rules.tar.gz\ntar xzf snort3-community-rules.tar.gz\nsudo cp snort3-community-rules\u002Fsnort3-community.rules \u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002Frules\u002F\n\n# Install PulledPork 3 for automated rule management\ngit clone https:\u002F\u002Fgithub.com\u002Fshirkdog\u002Fpulledpork3.git\ncd pulledpork3\nsudo python3 setup.py install\n\n# Configure PulledPork\nsudo tee \u002Fusr\u002Flocal\u002Fetc\u002Fpulledpork3\u002Fpulledpork.conf \u003C\u003C 'EOF'\nregistered_ruleset = true\noinkcode = \u003CYOUR_OINK_CODE>\nsnort_path = \u002Fusr\u002Flocal\u002Fbin\u002Fsnort\nlocal_rules = \u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002Frules\u002Flocal.rules\nsorule_path = \u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002Fso_rules\u002F\nsnort_version = 3.0.0.0\nblocklist_path = \u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002Flists\u002F\npid_path = \u002Fvar\u002Frun\u002Fsnort.pid\nips_policy = balanced\nEOF\n\n# Run PulledPork to fetch and process rules\nsudo pulledpork3 -c \u002Fusr\u002Flocal\u002Fetc\u002Fpulledpork3\u002Fpulledpork.conf\n```\n\n### Step 5: Write Custom Detection Rules\n\n```bash\n# Create local rules file\nsudo tee \u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002Frules\u002Flocal.rules \u003C\u003C 'EOF'\n# Detect reverse shell on common ports\nalert tcp $HOME_NET any -> $EXTERNAL_NET 4444 (\n    msg:\"LOCAL Possible Reverse Shell on port 4444\";\n    flow:established,to_server;\n    content:\"\u002Fbin\u002Fsh\"; nocase;\n    sid:1000001; rev:1;\n    classtype:trojan-activity;\n    priority:1;\n)\n\n# Detect Mimikatz execution indicators over SMB\nalert tcp any any -> $HOME_NET 445 (\n    msg:\"LOCAL Mimikatz Lateral Movement via SMB\";\n    flow:established,to_server;\n    content:\"|FF|SMB\";\n    content:\"mimikatz\"; nocase; distance:0;\n    sid:1000002; rev:1;\n    classtype:trojan-activity;\n    priority:1;\n)\n\n# Detect DNS tunneling (high-entropy long subdomain queries)\nalert udp $HOME_NET any -> any 53 (\n    msg:\"LOCAL Possible DNS Tunneling - Long Query Name\";\n    content:\"|01 00|\"; offset:2; depth:2;\n    byte_test:1,>,50,12;\n    sid:1000003; rev:1;\n    classtype:policy-violation;\n    priority:2;\n)\n\n# Detect cleartext password transmission via FTP\nalert tcp $HOME_NET any -> any 21 (\n    msg:\"LOCAL FTP Cleartext Password Detected\";\n    flow:established,to_server;\n    content:\"PASS \"; depth:5;\n    sid:1000004; rev:1;\n    classtype:policy-violation;\n    priority:2;\n)\n\n# Detect potential port scan (SYN flood pattern)\nalert tcp $EXTERNAL_NET any -> $HOME_NET any (\n    msg:\"LOCAL Possible Port Scan SYN Flood\";\n    flow:stateless;\n    flags:S,12;\n    threshold:type both, track by_src, count 100, seconds 10;\n    sid:1000005; rev:1;\n    classtype:attempted-recon;\n    priority:2;\n)\nEOF\n```\n\n### Step 6: Validate Configuration and Run\n\n```bash\n# Validate configuration\nsnort -c \u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002Fsnort.lua --daq-dir \u002Fusr\u002Flocal\u002Flib\u002Fdaq -T\n\n# Run Snort in IDS mode on the capture interface\nsudo snort -c \u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002Fsnort.lua --daq-dir \u002Fusr\u002Flocal\u002Flib\u002Fdaq \\\n  -i eth1 -l \u002Fvar\u002Flog\u002Fsnort -D\n\n# Test rules against a PCAP file\nsnort -c \u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002Fsnort.lua --daq-dir \u002Fusr\u002Flocal\u002Flib\u002Fdaq \\\n  -r test_traffic.pcap -l \u002Fvar\u002Flog\u002Fsnort\u002Ftest\u002F -A fast\n\n# Create systemd service for production deployment\nsudo tee \u002Fetc\u002Fsystemd\u002Fsystem\u002Fsnort.service \u003C\u003C 'EOF'\n[Unit]\nDescription=Snort 3 IDS\nAfter=network.target snort-iface.service\n\n[Service]\nType=simple\nExecStart=\u002Fusr\u002Flocal\u002Fbin\u002Fsnort -c \u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002Fsnort.lua --daq-dir \u002Fusr\u002Flocal\u002Flib\u002Fdaq -i eth1 -l \u002Fvar\u002Flog\u002Fsnort -D\nExecReload=\u002Fbin\u002Fkill -SIGHUP $MAINPID\nRestart=on-failure\n\n[Install]\nWantedBy=multi-user.target\nEOF\n\nsudo systemctl enable --now snort.service\n```\n\n### Step 7: Monitor Alerts and Tune Rules\n\n```bash\n# View real-time alerts\ntail -f \u002Fvar\u002Flog\u002Fsnort\u002Falert_fast.txt\n\n# Parse JSON alerts for analysis\ncat \u002Fvar\u002Flog\u002Fsnort\u002Falert_json.txt | python3 -m json.tool\n\n# Identify top triggered rules for tuning\ngrep -oP 'sid:\\d+' \u002Fvar\u002Flog\u002Fsnort\u002Falert_fast.txt | sort | uniq -c | sort -rn | head -20\n\n# Suppress noisy false-positive rules\nsudo tee -a \u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002Frules\u002Fsuppress.rules \u003C\u003C 'EOF'\nsuppress gen_id 1, sig_id 2100498, track by_src, ip 10.10.1.100\nsuppress gen_id 1, sig_id 2100366, track by_dst, ip 10.10.5.0\u002F24\nEOF\n\n# Verify rule count and performance\nsnort -c \u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002Fsnort.lua --daq-dir \u002Fusr\u002Flocal\u002Flib\u002Fdaq -T 2>&1 | grep -i \"rules loaded\"\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **IDS vs IPS** | IDS passively monitors traffic and generates alerts; IPS sits inline and can actively block or drop malicious packets in real time |\n| **Snort Rule** | Detection signature with header (action, protocol, src\u002Fdst, ports) and options (content matches, flow direction, metadata) that triggers on matching traffic |\n| **Preprocessor** | Snort component that normalizes and reassembles protocol-specific traffic before rule inspection, handling fragmentation, stream reassembly, and protocol anomalies |\n| **DAQ (Data Acquisition)** | Abstraction layer in Snort 3 that interfaces with packet capture mechanisms (AF_PACKET, PCAP, NFQ) for receiving network data |\n| **Oink Code** | Personal registration code from snort.org required to download Snort Subscriber or Registered rulesets |\n| **Threshold\u002FSuppression** | Tuning mechanisms that control alert frequency (threshold) or completely silence alerts from specific sources\u002Fdestinations (suppress) |\n\n## Tools & Systems\n\n- **Snort 3**: Open-source network intrusion detection and prevention system with Lua-based configuration and multithreaded architecture\n- **PulledPork 3**: Automated Snort rule management tool that downloads, processes, and deploys rulesets with policy-based filtering\n- **Barnyard2**: Dedicated spooler that reads Snort's unified2 binary output and writes to databases (MySQL, PostgreSQL) for SIEM integration\n- **Snorby**: Web-based Snort alert management console providing dashboards, event classification, and reporting\n- **tcpreplay**: Tool for replaying PCAP files through Snort to validate rules and test detection capabilities\n\n## Common Scenarios\n\n### Scenario: Deploying Snort IDS at a Network Perimeter for Compliance\n\n**Context**: A healthcare organization needs to deploy network IDS to meet HIPAA technical safeguard requirements. The IDS must monitor traffic between the DMZ and internal network, detect common attack patterns, and forward alerts to the existing Splunk SIEM. The network carries approximately 500 Mbps of traffic during peak hours.\n\n**Approach**:\n1. Install Snort 3 on a dedicated sensor with dual NICs -- one for monitoring (span port from core switch) and one for management\n2. Configure AF_PACKET DAQ with a 512 MB ring buffer to handle peak throughput without drops\n3. Deploy Snort Community rules plus Emerging Threats Open ruleset as baseline detection\n4. Write custom rules for organization-specific threats: detection of PHI data patterns (SSN, MRN formats) leaving the network, unauthorized access to DICOM\u002FHL7 ports, and connections to known bad IP lists\n5. Configure JSON alert output and forward to Splunk via syslog using rsyslog\n6. Run Snort against 24 hours of captured baseline traffic to identify false positives, then create suppression rules for legitimate traffic patterns\n7. Enable Snort as a systemd service with automatic restart and log rotation\n\n**Pitfalls**:\n- Deploying all available rules without tuning, overwhelming the sensor and SOC with thousands of daily false positives\n- Forgetting to disable NIC offloading, causing Snort to miss packets due to checksum errors or jumbo frames\n- Not sizing the sensor hardware for peak traffic, leading to packet drops during high-volume periods\n- Relying solely on community rules without custom rules for organization-specific threats and compliance requirements\n\n## Output Format\n\n```\n## Snort IDS Deployment Report\n\n**Sensor**: snort-sensor-01 (10.10.1.250)\n**Interface**: eth1 (span port from Core-SW1 gi0\u002F24)\n**Configuration**: \u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002Fsnort.lua\n**Ruleset**: Snort Community 3.0 + Local Rules (1,247 active rules)\n**HOME_NET**: 10.10.0.0\u002F16\n\n### Detection Summary (24-hour baseline)\n\n| Category | Alert Count | Top Rule SID |\n|----------|-------------|--------------|\n| Attempted Recon | 342 | 1:2100498 (ICMP ping) |\n| Trojan Activity | 12 | 1:1000001 (Reverse shell) |\n| Policy Violation | 87 | 1:1000004 (FTP cleartext) |\n| Web Application Attack | 23 | 1:2100654 (SQL injection) |\n\n### Tuning Actions Taken\n- Suppressed SID 2100498 for 10.10.1.100 (monitoring server legitimate ICMP)\n- Thresholded SID 1000004 to 5 alerts per source per hour\n- Added 3 custom rules for PHI exfiltration detection\n```\n",{"name":5,"tags":52,"author":53,"domain":36,"license":15,"version":54,"nist_csf":55,"subdomain":43,"description":60,"mitre_attack":61},[43,44,45,41,46],"mahipal","1.0",[56,57,58,59],"PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02","Installs, configures, and tunes Snort 3 to monitor network traffic for malicious activity using custom and community rulesets, preprocessors, and alert output plugins. Use when deploying network-based intrusion detection at key boundaries, writing custom Snort rules, tuning rulesets to reduce false positives, or integrating Snort alerts with a SIEM.\n",[62,63,64,65,66],"T1046","T1071.001","T1572","T1210","T1048","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fconfiguring-snort-ids-for-intrusion-detection",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":78,"prompt":88,"zipAvailable":89},[79,82,85],{"tool":80,"command":81},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill configuring-snort-ids-for-intrusion-detection",{"tool":83,"command":84},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill configuring-snort-ids-for-intrusion-detection",{"tool":86,"command":87},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill configuring-snort-ids-for-intrusion-detection","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconfiguring-snort-ids-for-intrusion-detection\u002FSKILL.md",true,[91,96,102,106,110,114,118,122,126,130,134,138,142,146,150],{"path":92,"resourceType":92,"resourceTypeDesc":93,"sizeBytes":94,"sourceHtmlUrl":95},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconfiguring-snort-ids-for-intrusion-detection\u002FLICENSE",{"path":97,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":100,"sourceHtmlUrl":101},"references\u002FAGENTS-CORE.md","REFERENCE","参考文档",26513,"https:\u002F\u002Fgithub.com\u002Fpydantic\u002Fpydantic-ai\u002Fblob\u002Fmain\u002Fpydantic_ai_slim\u002Fpydantic_ai\u002F.agents\u002Fskills\u002Fbuilding-pydantic-ai-agents\u002Freferences\u002FAGENTS-CORE.md",{"path":103,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":104,"sourceHtmlUrl":105},"references\u002Fapi-reference.md",2245,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconfiguring-snort-ids-for-intrusion-detection\u002Freferences\u002Fapi-reference.md",{"path":107,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":108,"sourceHtmlUrl":109},"references\u002FARCHITECTURE.md",16330,"https:\u002F\u002Fgithub.com\u002Fpydantic\u002Fpydantic-ai\u002Fblob\u002Fmain\u002Fpydantic_ai_slim\u002Fpydantic_ai\u002F.agents\u002Fskills\u002Fbuilding-pydantic-ai-agents\u002Freferences\u002FARCHITECTURE.md",{"path":111,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":112,"sourceHtmlUrl":113},"references\u002FCAPABILITIES-AND-HOOKS.md",26927,"https:\u002F\u002Fgithub.com\u002Fpydantic\u002Fpydantic-ai\u002Fblob\u002Fmain\u002Fpydantic_ai_slim\u002Fpydantic_ai\u002F.agents\u002Fskills\u002Fbuilding-pydantic-ai-agents\u002Freferences\u002FCAPABILITIES-AND-HOOKS.md",{"path":115,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":116,"sourceHtmlUrl":117},"references\u002FCOMMON-TASKS.md",5944,"https:\u002F\u002Fgithub.com\u002Fpydantic\u002Fpydantic-ai\u002Fblob\u002Fmain\u002Fpydantic_ai_slim\u002Fpydantic_ai\u002F.agents\u002Fskills\u002Fbuilding-pydantic-ai-agents\u002Freferences\u002FCOMMON-TASKS.md",{"path":119,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":120,"sourceHtmlUrl":121},"references\u002FINPUT-AND-HISTORY.md",28667,"https:\u002F\u002Fgithub.com\u002Fpydantic\u002Fpydantic-ai\u002Fblob\u002Fmain\u002Fpydantic_ai_slim\u002Fpydantic_ai\u002F.agents\u002Fskills\u002Fbuilding-pydantic-ai-agents\u002Freferences\u002FINPUT-AND-HISTORY.md",{"path":123,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":124,"sourceHtmlUrl":125},"references\u002FNATIVE-TOOLS.md",6399,"https:\u002F\u002Fgithub.com\u002Fpydantic\u002Fpydantic-ai\u002Fblob\u002Fmain\u002Fpydantic_ai_slim\u002Fpydantic_ai\u002F.agents\u002Fskills\u002Fbuilding-pydantic-ai-agents\u002Freferences\u002FNATIVE-TOOLS.md",{"path":127,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":128,"sourceHtmlUrl":129},"references\u002FON-DEMAND-CAPABILITIES.md",22547,"https:\u002F\u002Fgithub.com\u002Fpydantic\u002Fpydantic-ai\u002Fblob\u002Fmain\u002Fpydantic_ai_slim\u002Fpydantic_ai\u002F.agents\u002Fskills\u002Fbuilding-pydantic-ai-agents\u002Freferences\u002FON-DEMAND-CAPABILITIES.md",{"path":131,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":132,"sourceHtmlUrl":133},"references\u002FORCHESTRATION-AND-INTEGRATIONS.md",14624,"https:\u002F\u002Fgithub.com\u002Fpydantic\u002Fpydantic-ai\u002Fblob\u002Fmain\u002Fpydantic_ai_slim\u002Fpydantic_ai\u002F.agents\u002Fskills\u002Fbuilding-pydantic-ai-agents\u002Freferences\u002FORCHESTRATION-AND-INTEGRATIONS.md",{"path":135,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":136,"sourceHtmlUrl":137},"references\u002FTESTING-AND-DEBUGGING.md",6541,"https:\u002F\u002Fgithub.com\u002Fpydantic\u002Fpydantic-ai\u002Fblob\u002Fmain\u002Fpydantic_ai_slim\u002Fpydantic_ai\u002F.agents\u002Fskills\u002Fbuilding-pydantic-ai-agents\u002Freferences\u002FTESTING-AND-DEBUGGING.md",{"path":139,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":140,"sourceHtmlUrl":141},"references\u002FTOOLS-ADVANCED.md",22424,"https:\u002F\u002Fgithub.com\u002Fpydantic\u002Fpydantic-ai\u002Fblob\u002Fmain\u002Fpydantic_ai_slim\u002Fpydantic_ai\u002F.agents\u002Fskills\u002Fbuilding-pydantic-ai-agents\u002Freferences\u002FTOOLS-ADVANCED.md",{"path":143,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":144,"sourceHtmlUrl":145},"references\u002FTOOLS-CORE.md",7988,"https:\u002F\u002Fgithub.com\u002Fpydantic\u002Fpydantic-ai\u002Fblob\u002Fmain\u002Fpydantic_ai_slim\u002Fpydantic_ai\u002F.agents\u002Fskills\u002Fbuilding-pydantic-ai-agents\u002Freferences\u002FTOOLS-CORE.md",{"path":147,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":148,"sourceHtmlUrl":149},"references\u002FWORKSPACES.md",10368,"https:\u002F\u002Fgithub.com\u002Fpydantic\u002Fpydantic-ai\u002Fblob\u002Fmain\u002Fpydantic_ai_slim\u002Fpydantic_ai\u002F.agents\u002Fskills\u002Fbuilding-pydantic-ai-agents\u002Freferences\u002FWORKSPACES.md",{"path":151,"resourceType":152,"resourceTypeDesc":153,"sizeBytes":154,"sourceHtmlUrl":155},"scripts\u002Fagent.py","SCRIPT","脚本",7287,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconfiguring-snort-ids-for-intrusion-detection\u002Fscripts\u002Fagent.py",[157,182,206,234,260,287],{"skillNo":158,"name":159,"nameZh":6,"description":160,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":161,"categories":162,"keywords":164,"publishedAt":47},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[163],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[165,166,167,168,35,36,169,170,38,171,172,173,174,175,176,177,178,179,180,181],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":183,"name":184,"nameZh":6,"description":185,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":186,"categories":187,"keywords":189,"publishedAt":47},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[188],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[190,178,191,192,35,193,36,38,194,195,196,197,198,199,200,201,202,203,204,205],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":207,"name":208,"nameZh":6,"description":209,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":210,"categories":211,"keywords":216,"publishedAt":47},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[212,215],{"categoryNo":213,"categoryName":214,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[200,217,218,219,220,36,221,222,194,223,224,225,226,227,228,229,230,231,232,233],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":235,"name":236,"nameZh":6,"description":237,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":238,"categories":239,"keywords":241,"publishedAt":47},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[240],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[242,243,244,36,245,246,247,248,249,250,251,252,253,254,255,256,197,257,258,259],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":261,"name":262,"nameZh":6,"description":263,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":264,"categories":265,"keywords":267,"publishedAt":47},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[266],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[268,269,270,36,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":288,"name":289,"nameZh":6,"description":290,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":291,"categories":292,"keywords":294,"publishedAt":47},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[293],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[35,295,36,37,296,297,298,299,300,301,302,229,303,230,304,305,306,307,308,309],"triaging security incident","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]