What is PREPROCESSOR of SNORT engine?

[HWAN]

Hi teams,

I'm a beginner of Cisco firepower!

I have some questions!

I have no idea about preprocessor!

As to my knowledge, preprocessor is a plug-in of SNORT engine.

When LINA engine pass the packet, preprocessor get that packet.

Next, preprocessor deal with the packet whether pass or not.

In this progress,I don't know role of preprocessor.

Plus, If I have to optimize the intrusion rule, how can I address some rules related preprocessor like GID 124, or 125 etc?

Thank you.

[balaji.bandi]

First, i would suggest reading these flows so you can understand the flows and how they go each level and let us know what device is this? Firepower or ASA with SFR Module?

https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/212321-clarify-the-firepower-threat-defense-acc.html

[Marvin Rhoads · Accepted solution]

I would also refer you to Cisco Live presentation BRKSEC-3300. In it, the author explains the role of the preprocessors in your Network Analysis Policy and how/why you may want to tune them.

https://www.ciscolive.com/global/on-demand-library.html?search=brksec-3300#/session/1573153557475001JRgV

[HWAN]

Thank you for your reply!

There is no contents that I wants in the video.

But, It covers the overall thing about firepower. It's very useful information!

Thank you.