Re: Snort and Nessus Signature

[Vikram Phatak <vphatak () lucidsecurity com>]

Hi Crux,

It is not a simple matter to integrate Nessus & Snort since there are 
quite a few errors in the snort signatures, or in the supporting 
information for many of the snort signatures (CVE, BID, descriptions, 
etc.).  Also, many snort signatures do not have CVE, BID references 
since historically they have written based upon packet captures of 
specific exploits, (such as "Sasser") as opposed to vulnerabilities 
(LSASS), which is how CVE entries are sorted.  And there is no publicly 
available DB that I know of that correlates exploits to vulnerabilities.

So - In many cases, you will need to determine which vulnerability a 
specific exploit was written to take advantage of, and work your way 
back from there.

We (Lucid Security) have found that it was far more efficient (and 
reliable) to choose the OS & Application versions that we want to 
protect (MSFT, Linux, Solaris, Apache, IIS, SQL, etc.) and prioritize 
accordingly.  We then chose the appropriate CVE entries that met the 
requirements of our "filter" and wrote and tested signatures based upon 
the vulnerability accordingly.  If there was an existing signature that 
met our requirements, then great! But we found that was rarely the 
case.  The good news was that our resulting signature base could then be 
correlated not just by Nessus, but by OS Version, Application version, 
etc. so that we could use multiple methods to discover and profile 
devices on the network and increase the confidence of our correlated 
results..

I guess what I am trying to say is that without a lot of additional 
work, there is very little value in simply correlating Nessus to Snort 
via CVE & BID entries.  I am not trying to discourage you, but thought 
you might want to know what you are getting into prior to investing a 
lot of time and energy.  If you have any additional questions, please 
feel free to contact me.  Good luck with your efforts!

Best Regards,

   -Vik
--

Vikram Phatak
CTO, Lucid Security
http://www.lucidsecurity.com



cruxiezzzzz () yahoo com wrote:

> Hi All,
>
> I am doing some research into integrating Snort and Nessus together. 
> Just wondering if there are any Snort or Nessus Experts out there that 
> can tell me if there are using the same tables for their signatures? 
> cause i understand that they both use the CVE and BID tracking. Not to sure 
> bout the way their signatures are stored though. would be great if 
> anyone out there can shed some light on this.
>
> thanks alot
>
> Crux
>
> ------------------------------------------------------------------------
> Test Your IDS
>
> Is your IDS deployed correctly?
> Find out quickly and easily by testing it 
> with real-world attacks from CORE IMPACT.
> Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
> to learn more.
> ------------------------------------------------------------------------
>
>  


------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
------------------------------------------------------------------------