thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Intermediate

Snort

An open-source network intrusion detection and prevention system using rule-based signature matching, now maintained by Cisco.

Definition

Snort rules specify action, protocol, addresses, ports and detection options such as content, pcre and sid. Snort 3 is the current major version. Cisco Secure Firewall (Firepower) uses Snort as its IPS engine.

Example

alert tcp any any -> $HOME_NET 445 (msg:"SMB exploit attempt"; content:"|FF|SMB"; sid:1000001;)

Exam tip

Know basic Snort rule structure: header (action, protocol, IPs, ports, direction) and options in parentheses.

Related terms