This test was conducted using a custom rule in the local.rules file. The first part of the test was ensuring that the rule was recognized by Snort and generated in the Snorby interface. The second part of the test was ensuring when the action is changed to drop that the IPS is successfully able to drop the packet in real time.
آی-ویدئو