{“lastseen”:”2025-11-18T12:05:14″,”description”:”\\n\\nToday, Cisco Talos is introducing new capabilities for Snort3 users within Cisco Secure Firewall. These enhancements are designed to give you greater flexibility in how you manage, organize, and prioritize detection rules. They also make it easier to align SNORT\u00ae rules with your organization’s specific security needs.\\n\\n## The new \\”Severity\\” rule group\\n\\nIn Snort3, rule groups let you organize and manage detection rules according to specific criteria. Previously, only two top-level groups were available:\\n\\n * Rule Category: groups rules by Snort2 categories such as FILE-OTHER, MALWARE-CNC, etc.\\n * MITRE ATT\\u0026CK: groups rules by attacker behaviors and techniques\\n\\n\\n\\nThese groups allow you to set a security level from 0 (all rules disabled) to 4 (all rules enabled).\\n\\nThe new Severity rule group introduces a third way to organize rules — by vulnerability severity, using CVSS scores. Rules are grouped as low, medium, high, or critical, allowing your team to prioritize detection based on the impact and urgency of vulnerabilities, rather than just category or behavior.\\n\\nThis makes it easier to focus attention and resources where they matter most.\\n\\n## Flexible rule group creation based on time range\\n\\nWith the Severity group, you can define how far back in time you want your coverage to extend:\\n\\nLevel | Coverage | Description \\n—|—|— \\n0 | None | No rules enabled \\n1 | Last 2 years | Focuses on recent, high-impact vulnerabilities \\n2 | Last 5 years | Balanced coverage of recent and mid-term threats \\n3 | Last 10 years | Broad coverage for long-lived environments \\n4 | All | Includes all vulnerabilities detected to date \\n \\nThis approach gives you precise control over rule selection and volume. It helps optimize performance while ensuring your detection policies match your organization’s patching cycles, compliance requirements, and risk profile.\\n\\nWe’re also looking to develop more top-level groupings in the coming quarters. More details will be shared in due course.\\n\\n## What this means for your environment\\n\\nConfiguring Snort3 previously required enabling rules individually or applying a predefined ruleset and then tuning manually. We know this wasn’t the most time-efficient process, so the Snort analyst team worked to simplify it with the new features announced today.\\n\\nYou can now:\\n\\n * Enable rule groups aligned with your own internal policies\\n * Scale configurations across multiple environments without managing individual rules\\n * Adjust detection depth easily by time range or severity level\\n\\n\\n\\nThese capabilities make it simpler to maintain consistent, targeted detection coverage — whether you’re running large, distributed networks or smaller environments with tailored security priorities.\\n\\n## Conclusion\\n\\nThe new Severity rule group and expanded rule group model give Snort3 users more flexibility and control.\\n\\nBy organizing rules based on vulnerability severity and timeframe, you can focus detection where it has the greatest impact, improving both efficiency and accuracy in threat management.”,”published”:”2025-11-18T11:00:25″,”modified”:”2025-11-18T11:00:25″,”type”:”talosblog”,”title”:”New in Snort3: Enhanced rule grouping for greater flexibility and control”,”source”:””,”references”:””,”id”:”TALOSBLOG:8100088E7CCD4454C10FA919A497A37C”,”bulletinFamily”:”blog”,”cwe”:null,”cvelist”:[],”sourceData”:””,”sourceHref”:””,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/blog.talosintelligence.com\/new-in-snort3-enhanced-rule-grouping-for-greater-flexibility-and-control\/”,”category_name”:”News”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-11-18T12:05:14″,”description”:”\\n\\nToday, Cisco Talos is introducing new capabilities for Snort3 users within Cisco Secure Firewall. These…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[6,8,12,13,33,7,69,11,5],"class_list":["post-26646","post","type-post","status-publish","format-standard","hentry","category-category_news","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-security","tag-talosblog","tag-tapic","tag-vulnerability"],"yoast_head":"\n