diff options
Diffstat (limited to 'doc/userguide/rules/ip-reputation-rules.rst')
| -rw-r--r-- | doc/userguide/rules/ip-reputation-rules.rst | 45 |
1 files changed, 45 insertions, 0 deletions
diff --git a/doc/userguide/rules/ip-reputation-rules.rst b/doc/userguide/rules/ip-reputation-rules.rst new file mode 100644 index 0000000..f0b5f18 --- /dev/null +++ b/doc/userguide/rules/ip-reputation-rules.rst @@ -0,0 +1,45 @@ +IP Reputation Keyword +===================== + +IP Reputation can be used in rules through a new rule keyword "iprep". + +For more information about IP Reputation see :doc:`/reputation/ipreputation/ip-reputation-config` and :doc:`/reputation/ipreputation/ip-reputation-format`. + +iprep +----- + +The iprep directive matches on the IP reputation information for a host. + +:: + + iprep:<side to check>,<category>,<operator>,<reputation score> + + +side to check: <any|src|dst|both> + +category: the category short name + +operator: <, >, = + +reputation score: 1-127 + +Example: + +:: + + + alert ip $HOME_NET any -> any any (msg:"IPREP internal host talking to CnC server"; flow:to_server; iprep:dst,CnC,>,30; sid:1; rev:1;) + +This rule will alert when a system in $HOME_NET acts as a client while communicating with any IP in the CnC category that has a reputation score set to greater than 30. + +IP-only +~~~~~~~ + +The "iprep" keyword is compatible to "IP-only" rules. This means that a rule like: + +:: + + + alert ip any any -> any any (msg:"IPREP High Value CnC"; iprep:src,CnC,>,100; sid:1; rev:1;) + +will only be checked once per flow-direction. |