Prepare custom rules for snort 3 conversion
Before converting from Snort 2 to Snort 3, make sure you are prepared to manage your custom rule set for Snort 3.
-
If you are using a rule set from a third-party vendor, contact that vendor to confirm that their rules will successfully convert to Snort 3 or to obtain a replacement rule set written natively for Snort 3.
-
If you have custom rules that you have written yourself, familiarize yourself with writing Snort 3 rules before converting, so you can update your rules to optimize Snort 3 detection after conversion.
Learn more about writing rules in Snort 3:
-
https://blog.snort.org/2020/08/how-rules-are-improving-in-snort-3.html
-
https://blog.snort.org/2020/10/talos-transition-to-snort-3.html
You can refer to other blogs at https://blog.snort.org/ to learn more about Snort 3 rules.
Important | Snort 2 network analysis policy (NAP) settings cannot be copied to Snort 3 automatically. NAP settings must be manually replicated in Snort 3. |