topic Snort3 rate filter in Network Security

Snort3 rate filter

Jiri Tyl — Thu, 26 Jun 2025 07:54:35 GMT

Hello,

Im trying to configure rate filter in Firepower Snort3 according to this reference: https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/snort3-inspectors/snort-3-inspector-reference/rate-filter-inspector.html

For single rate filter with single GID:SIG combination it is working as expected. But I would like to configure more rate filters, or at least activate rate-filter for this three intrusion rules 135:1, 135:2, 135:3 for single IP address.

In the reference is written: "You can define multiple rate-based filters on the same rule as well as on different rules." And my question is: Does anybody please know how to do this...?

Thanks

Re: Snort3 rate filter

MHM Cisco World — Thu, 26 Jun 2025 08:12:35 GMT

Sorry can you more elaborate

You need many rate limit for same rule

Or rate limit for many rule

Thanks

MHM

Re: Snort3 rate filter

Jiri Tyl — Thu, 26 Jun 2025 08:26:14 GMT

Yes, I can elaborate more. I need many rate limit for same rule.

Thanks Jiri

Re: Snort3 rate filter

Jiri Tyl — Thu, 26 Jun 2025 12:08:21 GMT

I finally found a solution to my problem. Maybe I can save someone some time...

Data is array, there under is correct JSON syntax for multiple filter items. On top of this, you should set the corresponding action in the intrussion rule overrides (if it is not in default) for the used GID:SIG ( for me 135:1, 135:2 and 135:3).

{
"rate_filter": {
"type": "singleton",
"enabled": true,
"data": [
{
"apply_to": "[X.X.X.X]",
"count": 10,
"gid": 135,
"new_action": "block",
"seconds": 1,
"sid": 1,
"timeout": 30,
"track": "by_dst"
},
{
"apply_to": "[X.X.X.X]",
"count": 10,
"gid": 135,
"new_action": "block",
"seconds": 1,
"sid": 2,
"timeout": 30,
"track": "by_dst"
},
{
"apply_to": "[X.X.X.X]",
"count": 10,
"gid": 135,
"new_action": "block",
"seconds": 1,
"sid": 3,
"timeout": 30,
"track": "by_dst"
}
]
}
}

Re: Snort3 rate filter

MHM Cisco World — Thu, 26 Jun 2025 14:20:57 GMT

The code you use is not for same rule

GID:SIG

I think you use SIG 1'2'3

Anyway I think I found solution but I will more check it before answer you

Thanks

MHM

Re: Snort3 rate filter

MHM Cisco World — Sat, 05 Jul 2025 12:17:19 GMT

Check this if this what you looking for

https://rayka-co.com/lesson/cisco-firepower-event-suppression/

https://www.cisco.com/c/en/us/support/docs/security/secure-firewall-threat-defense/221881-configure-custom-local-snort-rules-in-sn.html

MHM