# Most of the snort rules are from Emerging Threats (http://www.emergingthreats.net/)
#
# In order to use different rulesets, please point the variable snort_rules,
# defined below (in [defaults]), to your local file(s).
#
[defaults]
priority=4
max_enable=3
actions=email,log
auto_enable=Y
enabled=N
grace=120m
button_text=Enable Network
snort_rules=local.rules,emerging-attack_response.rules,emerging-botcc.rules,emerging-exploit.rules,emerging-malware.rules,emerging-p2p.rules,emerging-scan.rules,emerging-shellcode.rules,emerging-trojan.rules,emerging-virus.rules,emerging-worm.rules
# vlan: The vlan parameter allows you to define in what vlan a node with a violation will be put in.
# accepted values are the vlan names: isolationVlan, normalVlan, registrationVlan, macDetectionVlan, guestVlan, 
#                                     customVlan1, customVlan2, customVlan3, customVlan4, customVlan5 
# (see switches.conf)
vlan=isolationVlan
# if you add a category here, nodes in these categories will be immune to the violation
whitelisted_categories=

[1100001]
desc=Scan
# On a Scan violation priority must be higher (lower number) than the special system scan violation (1200001)
priority=4
url=/remediation.php?template=failed_scan
max_enable=4
button_text=Scan my computer again
trigger=Scan::10861,Scan::10943,Scan::11177,Scan::11231,Scan::11302,Scan::11304,Scan::11528,Scan::11595,Scan::11664,Scan::11787,Scan::11790,Scan::11803,Scan::11808,Scan::11835,Scan::11878,Scan::11886,Scan::11887,Scan::11921,Scan::12051,Scan::12052,Scan::12054,Scan::12092,Scan::12208,Scan::12209,Scan::13641,Scan::13852,Scan::14724,Scan::15460,Scan::15894,Scan::15970,Scan::16324,Scan::16326,Scan::16327,Scan::16328,Scan::16329,Scan::18020,Scan::18021,Scan::18023,Scan::18025,Scan::18027,Scan::18028,Scan::18215,Scan::18482,Scan::18483,Scan::18490,Scan::18502,Scan::18681,Scan::18682,Scan::19401,Scan::19402,Scan::19406,Scan::19408,Scan::20005,Scan::20172,Scan::20299,Scan::20368,Scan::20382,Scan::20389,Scan::20390,Scan::20904,Scan::20905,Scan::21213,Scan::21332,Scan::21685,Scan::21687,Scan::22030,Scan::22034,Scan::22183,Scan::22184,Scan::22185,Scan::22186,Scan::22187,Scan::22192,Scan::22194,Scan::22332,Scan::22449,Scan::22530,Scan::23644,Scan::23646,Scan::23647,Scan::23833,Scan::23835,Scan::23837,Scan::23838,Scan::23999,Scan::24000
actions=trap,email,log
enabled=Y
# for faster remediation, it is recommended to leave an offending client in the registration vlan (where it is scanned)
vlan=registrationVlan

#
# Example config to block a whole class of devices based on their MAC address
# Trigger format: The number is a decimal representation of the OUI (Vendor) portion of the MAC.
# To generate such a representation you can use perl -e "print hex('001620');"
# There is a copy of the oui.txt file in conf/ to help you match vendor name and vendor mac.
#
[1100002]
desc=MAC Vendor isolation example
url=/remediation.php?template=banned_devices
trigger=VENDORMAC::5664
actions=trap,email,log
enabled=N

#
# Example config to block an OS based on their dhcp fingerprint
# Trigger format: an id (defined as os_id in os_type table)
# Right now the only way to find the os id is to query the database but it should be feasible
# from the pfcmd tool or the web gui in the future.
# From a MySQL prompt, a 'select * from os_type;' will give you what you need. Just put in 
# the os_id next to OS::. In exemple to block Windows 95 you would use: OS::104
#
# The below example blocks Windows 95, 98, 98SE, NT4 and ME.
#
[1100003]
desc=Ancient OS isolation example
url=/remediation.php?template=banned_os
trigger=OS::104,OS::103,OS::106,OS::105,OS::102
actions=trap,email,log
enabled=N

#
# Example config to block a specific Browser User Agent
# This works in the same way as OS does.
# Trigger format: an id (as in configuration -> user-agent )
#
[1100004]
desc=Browser isolation example
url=/remediation.php?template=banned_devices
trigger=USERAGENT::101,USERAGENT::102
actions=trap,email,log
enabled=N

[1100005]
desc=P2P Isolation (snort example)
url=/remediation.php?template=p2p
trigger=Detect::2001808,Detect::2000334,Detect::2000357,Detect::2000369,Detect::2000330,Detect::2000331,Detect::2000332,Detect::2000333,Detect::2001296,Detect::2001297,Detect::2001298,Detect::2001299,Detect::2001305,Detect::2001300,Detect::2001664,Detect::2002760,Detect::2002761,Detect::2001796,Detect::2001812
actions=trap,email,log
enabled=N

[1100006]
desc=Auto-register Device example
priority=1
trigger=OS::3,OS::6,OS::7,OS::8,OS::10,OS::12,OS::13
actions=log,autoreg
enabled=N

[1100007]
desc=Disable NATing Routers and APs
url=/remediation.php?template=nat
trigger=Detect::1100005,Detect::1100006,Detect::1100007,OS::4
actions=trap,email,log
enabled=N

#
# Example config to be alerted of the presence of one specific MAC address in the network.
# Useful for stolen devices if you happen to know the MAC of a stolen device.
# Trigger format: The number is a decimal representation of the MAC.
# To generate such a representation you can use perl -e 'print hex("f04da2cbd9c5"),"\n";'. Ignore the warning.
#
[1100008]
desc=MAC isolation example
url=/remediation.php?template=banned_devices
trigger=MAC::264216234416581
actions=email,log
enabled=N

[1100010]
desc=Rogue DHCP
url=/remediation.php?template=roguedhcp
trigger=internal::1100010
actions=email,log
enabled=Y

#
#  1200000 - 120099 Reserved for required administration violations
#
[1200001]
priority=9
desc=System Scan
# someone should always be able to try to scan its system again
max_enable=0
grace=1s
url=/remediation.php?template=system_scan
actions=trap,log
button_text=Scan
enabled=N
# Scan is taking place in the registration vlan don't change this value. 
vlan=registrationVlan

#
# 1300000 - 1399999 Reserved for PacketFence violations
#
[1300000]
desc=Generic
priority=8
actions=trap,log
url=/remediation.php?template=generic
enabled=Y

[1300001]
desc=Spam
priority=6
actions=trap,log
url=/remediation.php?template=spam
enabled=Y

#
# 1400000 - 1499999 Reserved for local violations
#
#
# 2000000 - 2099999 Snort violations
#
[2000000]
desc=Malware
priority=4
url=/remediation.php?template=malware
enabled=N
action=trap,email,log
# For conficker: Detect::2008802,Detect::2008803,Detect::2009024,Detect::2009114,Detect::2009200,Detect::2009201
trigger=Detect::2008802,Detect::2008803,Detect::2009024,Detect::2009114,Detect::2009200,Detect::2009201

[2000032]
desc=LSASS Exploit
priority=4
url=/remediation.php?template=lsass
redirect_url=/proxies/tools/stinger.exe
enabled=N
trigger=Detect::2000032,Detect::2000033,Detect::2000046,Detect::2001286,Detect::2001337,Detect::2001302

[2002030]
desc=IRC Trojan
priority=3
auto_enable=N
url=/remediation.php?template=trojan
enabled=N
trigger=Detect::2002029,Detect::2002030,Detect::2002031,Detect::2002032,Detect::2002033,Detect::2000345,Detect::2000347,Detect::2000348,Detect::2000349,Detect::2000350,Detect::2000351,Detect::2000352
actions=trap,email,log

# The following signatures replace the generic portscan detector.  It was notoriously noisy, expecially
# for BitTorrent clients.  These new signatures look for most of the "worm-like" scanning behaviors.
[2002201]
desc=Zotob (W32.Zotob and variants)
priority=4
url=/remediation.php?template=zotob
enabled=N
trigger=Detect::2002201,Detect::2002203

[2001904]
desc=Telnet Scan
priority=6
url=/remediation.php?template=scanning
enabled=N
auto_enable=N
trigger=Detect::2001904

[2001972]
desc=Remote Desktop Scan
priority=6
url=/remediation.php?template=scanning
enabled=N
auto_enable=N
trigger=Detect::2001972

[2001569]
desc=NetBIOS Scan
priority=6
url=/remediation.php?template=scanning
enabled=N
auto_enable=N
trigger=Detect::2001569,Detect::2001579,Detect::2001580,Detect::2001581,Detect::2001582,Detect::2001583

# The following are peer-to-peer (P2P) signatures.  They can be exceedingly loud, but seem fairly accurate in our experience.
# Since P2P is not considered illicit on all networks, they are all shipped disabled - set disable=N to enable.
[2000334]
desc=P2P (BitTorrent)
priority=8
url=/remediation.php?template=p2p
enabled=N
max_enable=1
trigger=Detect::2000334,Detect::2000357,Detect::2000369

[2001808]
desc=P2P (Limewire)
priority=8
url=/remediation.php?template=p2p
enabled=N
max_enable=1
trigger=Detect::2001808

[2000330]
desc=P2P (eDonkey)
priority=8
url=/remediation.php?template=p2p
enabled=N
max_enable=1
trigger=Detect::2000330,Detect::2000331,Detect::2000332,Detect::2000333,Detect::2001296,Detect::2001297,Detect::2001298,Detect::2001299,Detect::2001305,Detect::2001300

[2001664]
desc=P2P (Gnutella)
priority=8
url=/remediation.php?template=p2p
enabled=N
max_enable=1
trigger=Detect::2001664,Detect::2002760,Detect::2002761

[2001812]
desc=P2P (Kazaa)
priority=8      
url=/remediation.php?template=p2p
enabled=N
max_enable=1
trigger=Detect::2001796,Detect::2001812

#
# 3000000 - 3099999 Device bans
#
[3000001]
desc=Block all mobile devices
url=/remediation.php?template=banned_devices
actions=email,log,trap
enabled=N
priority=10
trigger=USERAGENT::300,OS::11

[3000002]
desc=Block iPhone and iPod touch
url=/remediation.php?template=banned_devices
actions=trap,email,log
enabled=N
priority=10
trigger=OS::1102,USERAGENT::101,USERAGENT::102

# MAC vendors: 00:0f:86, 00:1c:cc, 00:21:06, 00:23:7a, 00:24:9f, 00:25:57
[3000003]
desc=Block BlackBerries
url=/remediation.php?template=banned_devices
actions=trap,email,log
enabled=N
priority=10
trigger=VENDORMAC::3974,VENDORMAC::7372,VENDORMAC::8454,VENDORMAC::9082,VENDORMAC::9375,VENDORMAC::9559,USERAGENT::103

[3000004]
desc=Block PS3 and PSP
url=/remediation.php?template=banned_devices
actions=trap,email,log
enabled=N
priority=10
trigger=USERAGENT::111,USERAGENT::112,OS::605

# MAC vendor: 00:13:b6
[3000005]
desc=Block Slingbox
url=/remediation.php?template=banned_devices
actions=trap,email,log
enabled=N
priority=10
trigger=VENDORMAC::5046,OS::703
