Global Settings

The Global Settings tab under Services > Snort 3 contains options which apply to all Snort interfaces.

Snort 3 Service

This field indicates the installation status and current Snort 3.x version.

Rules Download Service

Rules Download Service entries enable Netgate Nexus to periodically update Snort rules from remote services.

Some of these services may require authentication. For example, some rules from snort.org require the use of an “oinkcode” within the URL.

List

This section of the page displays a list of Rules Download Services entries and controls for those entries.

At the top of the list is a Add Rules Download Service button to create a new entry.

The list contains the following columns:

Service

The custom Name given to the service.

Address

The URL for the service along with its status. The status includes the date when Netgate Nexus last updated the rules, the hash of the downloaded archive file, download progress, and last update result.

Update

The unlabeled column after Address contains buttons to manually update the rules. The available buttons change based on the current state.

Start Downloading

Click to trigger an immediate manual update of the service.

Pause Downloading

Click to temporarily pause an in-progress update, which can be resumed later.

Stop Downloading

Click to cancel an in-progress update.

State

The current state of the service, e.g. enabled or disabled.

Entry Actions

The last column contains icons to alter the service.

Edit

Click to edit the service.

Delete

Click to delete the service.

Add/Edit Rules Download Service

The same options are available when editing an existing service or creating a new service.

To create a new entry, click Add Rules Download Service at the top of the list. To edit an existing entry, click at the end of its row in the list.

The available options are:

Enable

Controls whether this service is enabled or disabled.

Name

A short name for the service, e.g. ET_Open.

URL

The full URL to the rules archive.

The rules are typically version-specific and may contain authentication codes.

Common examples for version 3.12.2 include:

Emerging Threats Open Rules

https://rules.emergingthreats.net/open/snort-3.12.2/emerging.rules.tar.gz

Snort Registered Rules

https://www.snort.org/rules/snortrules-snapshot-31210.tar.gz?oinkcode=<oinkcode>

Talos Light SPD

https://www.snort.org/rules/Talos_LightSPD.tar.gz?oinkcode=<oinkcode>

Checksum File URL

Optional URL to a file containing a checksum to match. This can help ensure the archive download is authentic and complete.

Description

A longer text description of this service.

Advanced

These options are not typically required for most services.

Skip certificate check

Disables verification of the server certificate. This may be necessary for some self-hosted servers that lack a certificate from a trusted CA.

Certificate fingerprint

The fingerprint for a certificate to ensure that only a specific certificate is validated, rather than trusting typical certificate validation.

Rules Download Schedule

This section configures schedules for Snort rule updates. This instructs Netgate Nexus to periodically download and update rules from the defined Rules Download Service entries.

Enable

This toggle enables scheduled updates. When disabled, rules must be updated manually.

Interval

Sets the interval at which Netgate Nexus will update rules. Each interval has a different set of options.

Daily

Updates rules once per day at a specific time of day.

Weekly

Updates rules once per week on a given day of the week and time of day.

Day (of week)

The day of the week when Netgate Nexus will update rules, e.g. Sunday.

Monthly

Updates rules once per month on a specific day of the month and time of day.

Day (of month)

The day of the month when Netgate Nexus will update rules, e.g. 15.

Warning

Avoid configuring a value which is not in every month or the rule update will be skipped during months that do not have the chosen value. For example, values of 30 and 31 will not run during any February.

Time

Each Interval has a Time component. This is the time of day when Netgate Nexus will update the rules. It can be set to any hour of the day (24-hour format) at 1 minute increments.

Warning

If the device is configured with a time zone which observes Daylight Saving Time, avoid time values that may be skipped or duplicated during the Daylight Saving Time changes. For example, during the Spring change, times between 02:00 and 02:59 are skipped. During the Fall change, times between 01:00 and 01:59 occur twice.

Tip

When setting a Time, the clock can be set by clicking and dragging or clicking anywhere around the dial. For example, it displays minutes in 5 minute increments but can set any minute by clicking between the printed numbers or dragging to pick a specific minute value.

The value may also be entered manually by clicking in the hour and minute boxes at the top and typing a value directly.