Guest User!

You are not Sophos Staff.

This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

How to upload and insert snort rules to my Sophos Firewall X85 ?

Excuse me, how to upload and insert snort rules to my Sophos Firewall X85 ?

1. I have snort rules list as .txt, but I couldn't find a method to insert it. Does you support snort rules?

2. I tried to use API like { https://<Sophos IP>:<port>/webconsole/APIController?reqxml=<Request><Login><Username>admin</Username><Password passwordform="encrypt">my password</Password></Login></Request> } but it failed. I thought the  encrypted password is wrong because I used unencrypted password. Where to find it and the API document with example.

3. How to convert the snort rule txt format to API XML format or use command line to use it ?

such like:
    alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"APP-DETECT TeamViewer remote administration tool outbound connection attempt"; flow:to_server; content:"client=DynGate"; fast_pattern:only; http_uri; metadata:policy balanced-ips drop, policy security-ips drop, service http; reference:url,en.wikipedia.org/wiki/TeamViewer; classtype:policy-violation; sid:34463; rev:1;)

  # alert tcp $HOME_NET any -> any   //not using rule

    alert udp $HOME_NET any -> any 53 (msg:"APP-DETECT DNS request for Dynamic Internet Technology domain dfgvx.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"|05|dfgvx|03|com|00|"; fast_pattern:only; metadata:policy security-ips drop, service dns; reference:url,wikipedia.org/wiki/Freegate; classtype:misc-activity; sid:27984; rev:1;)

 

 

 



This thread was automatically locked due to age.
Parents Reply Children
No Data