A step by step guide for Ubuntu 16.04 which explains how to :
Snort has a package for Ubuntu. This installs all components required.
apt-get update apt-get install snort
Also install oinkmaster , which also has an Ubuntu package
apt-get install oinkmaster
We like the ET and ET Pro rulesets for a number of reasons. If you wish to remain with the Snort community rules or move to the excellent Talos ruleset, you can skip this step.
cd /etc/snort mv rules rules_old wget https://rules.emergingthreats.net/open/snort-2.9.0/emerging.rules.tar.gz tar xf emerging.rules.tar.gz -C /etc/snort
Open snort.conf and copy the lines from rules/emerging.conf into snort.conf and comment out the old snort.conf rules.
This is a bit of a chore, but you only do this once.
If you dont do this, you will find out soon enough. Many ET rules wont load
ipvar HOME_NET 192.168.0.0/16,10.0.0.0/8
Oinkmaster will keep the rules updated.
Open /etc/oinkmaster.conf and add the ET (or ET-Pro) rule path using the
# EMERGING THREATS COMMUNITY url = https://rules.emergingthreats.net/open/snort-2.9.0/emerging.rules.tar.gz
Then you can test it out
oinkmaster -C /etc/oinkmaster.conf -o /etc/snort/rules
The following crontab entry will
crontab -e and add the following line
0 2 * * * root ( /usr/sbin/oinkmaster -C /etc/oinkmaster.conf -o /etc/snort/rules; sleep 5; kill -USR1 `pidof -s snort` )
That is pretty much it.
First stop the old instance of snort
Then Login to Trisul as admin/admin ;
You're all done.
To view analytics in Trisul you can start with the Real Time Alerts dashboard.