The Snort team has recently released OpenAppID – the open source implementation of application identification and control. Using this free software you can now implement these next gen features for free! This will provide detailed statistics about what applications are being used in your environment. And with the Snort rules language adapting to this data you can easily write rules to block specific applications (or significantly reduce false positives in other rules). I will show you how to do this, as well as how to write your own application detectors.

Back to Derbycon 2014 video list