[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ET56PHHV0Y2G4PRTC8JC5M":3,"skill-same:01M6ET56PHHV0Y2G4PRTC8JC5M":103},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":64,"commitSha":65,"skillDirectory":66,"forksCount":14,"repositoryHtmlUrl":67,"repositoryHomepageUrl":68,"ownerHtmlUrl":69,"ownerBlogUrl":6,"ownerDescription":70,"updatedAt":71,"install":72,"resources":85},"01M6ET56PHHV0Y2G4PRTC8JC5M","configuring-snort-ids-for-intrusion-detection",null,"Installs, configures, and tunes Snort 3 intrusion detection system to monitor network traffic for malicious activity using custom and community rulesets, preprocessors, and alert output plugins on authorized network segments.","henriquescastilho\u002Fmy-claude","henriquescastilho","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F153296945?v=4","01M6ESH7EXPXTH9CVQ4K16SRG8","Henrique Scheer","01M6ESH7JHEK2PTNNH4HEH787Z",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fconfiguring-snort-ids-for-intrusion-detection\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"detection","configuring snort ids for intrusion detection","snort","ids","activity","writing","de","community","cm","alert","system","rule-writing","network-security","network","intrusion-detection","monitor","pr","cybersecurity","security","malicious","2026-11-10 10:12:30",false,"---\nname: configuring-snort-ids-for-intrusion-detection\ndescription: 'Installs, configures, and tunes Snort 3 intrusion detection system to\n  monitor network traffic for malicious activity using custom and community rulesets,\n  preprocessors, and alert output plugins on authorized network segments.\n\n  '\ndomain: cybersecurity\nsubdomain: network-security\ntags:\n- network-security\n- snort\n- ids\n- intrusion-detection\n- rule-writing\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.IR-01\n- DE.CM-01\n- ID.AM-03\n- PR.DS-02\nmitre_attack:\n- T1046\n- T1071.001\n- T1572\n- T1210\n- T1048\n---\n# Configuring Snort IDS for Intrusion Detection\n\n## When to Use\n\n- Deploying a network-based intrusion detection system to monitor traffic at key network boundaries\n- Writing custom Snort rules to detect organization-specific threats, attack patterns, or policy violations\n- Tuning existing rulesets to reduce false positives while maintaining detection coverage\n- Integrating Snort alerts with SIEM platforms for centralized security monitoring\n- Validating network security controls by generating test traffic and confirming detection\n\n**Do not use** as a replacement for endpoint detection, for monitoring encrypted traffic without TLS inspection, or as the sole security control without complementary defenses.\n\n## Prerequisites\n\n- Snort 3.x installed from source or package manager (`snort --version` to verify)\n- Network interface configured for promiscuous mode on a span port or network tap\n- DAQ (Data Acquisition Library) installed for packet capture integration\n- Registered Snort account for downloading Snort Subscriber (paid) or Community rulesets from snort.org\n- PulledPork 3 or similar rule management tool for automated ruleset updates\n- Sufficient CPU and memory for inline traffic inspection at line rate\n\n## Workflow\n\n### Step 1: Install and Verify Snort 3\n\n```bash\n# Install dependencies (Ubuntu\u002FDebian)\nsudo apt install -y build-essential libpcap-dev libpcre3-dev libnet1-dev \\\n  zlib1g-dev luajit hwloc libdumbnet-dev bison flex libcmocka-dev \\\n  libnetfilter-queue-dev libmnl-dev autotools-dev libluajit-5.1-dev \\\n  pkg-config cmake libhwloc-dev liblzma-dev openssl libssl-dev cpputest \\\n  libsqlite3-dev uuid-dev\n\n# Install DAQ from source\ngit clone https:\u002F\u002Fgithub.com\u002Fsnort3\u002Flibdaq.git\ncd libdaq && .\u002Fbootstrap && .\u002Fconfigure && make && sudo make install\n\n# Install Snort 3\ngit clone https:\u002F\u002Fgithub.com\u002Fsnort3\u002Fsnort3.git\ncd snort3 && .\u002Fconfigure_cmake.sh --prefix=\u002Fusr\u002Flocal\ncd build && make -j$(nproc) && sudo make install\nsudo ldconfig\n\n# Verify installation\nsnort -V\n```\n\n### Step 2: Configure Network Interfaces\n\n```bash\n# Disable offloading features that interfere with packet inspection\nsudo ethtool -K eth1 gro off lro off tso off gso off rx off tx off\n\n# Enable promiscuous mode\nsudo ip link set eth1 promisc on\n\n# Create systemd service for persistent interface configuration\nsudo tee \u002Fetc\u002Fsystemd\u002Fsystem\u002Fsnort-iface.service \u003C\u003C 'EOF'\n[Unit]\nDescription=Configure Snort capture interface\nBefore=snort.service\n\n[Service]\nType=oneshot\nExecStart=\u002Fsbin\u002Fethtool -K eth1 gro off lro off tso off gso off rx off tx off\nExecStart=\u002Fsbin\u002Fip link set eth1 promisc on\nRemainAfterExit=yes\n\n[Install]\nWantedBy=multi-user.target\nEOF\n\nsudo systemctl enable snort-iface.service\n```\n\n### Step 3: Configure Snort 3 with Lua Configuration\n\n```bash\n# Create Snort directory structure\nsudo mkdir -p \u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002F{rules,builtin_rules,lists,appid}\nsudo mkdir -p \u002Fvar\u002Flog\u002Fsnort\n\n# Edit the main Snort configuration\nsudo tee \u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002Fsnort.lua \u003C\u003C 'LUAEOF'\n-- Snort 3 Configuration\n\n-- Network variables\nHOME_NET = '10.10.0.0\u002F16'\nEXTERNAL_NET = '!$HOME_NET'\n\n-- Path variables\nRULE_PATH = '\u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002Frules'\nBUILTIN_RULE_PATH = '\u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002Fbuiltin_rules'\n\n-- Configure DAQ\ndaq = {\n    module_dirs = { '\u002Fusr\u002Flocal\u002Flib\u002Fdaq' },\n    modules = { { name = 'afpacket', variables = { 'buffer_size_mb=256' } } }\n}\n\n-- Decoder configuration\nnormalizer = { tcp = { ips = true } }\n\n-- Stream inspection\nstream = { }\nstream_tcp = { policy = 'linux', session_timeout = 180 }\nstream_udp = { session_timeout = 30 }\nstream_icmp = { }\n\n-- HTTP inspection\nhttp_inspect = { }\n\n-- DNS inspection\ndns = { }\n\n-- SSL\u002FTLS inspection\nssl = { }\n\n-- SMB inspection\ndce_smb = { }\n\n-- File identification and processing\nfile_id = { rules_file = '\u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002Ffile_magic.rules' }\n\n-- Port scan detection\nport_scan = {\n    protos = 'all',\n    scan_types = 'all',\n    memcap = 10000000\n}\n\n-- Reputation-based filtering\n-- reputation = {\n--     blacklist = RULE_PATH .. '\u002Fblocklist.rules'\n-- }\n\n-- IPS rules\nips = {\n    enable_builtin_rules = true,\n    include = RULE_PATH .. '\u002Fsnort3-community.rules',\n    variables = {\n        nets = { HOME_NET = HOME_NET, EXTERNAL_NET = EXTERNAL_NET },\n        ports = {\n            HTTP_PORTS = '80 8080 8443',\n            SSH_PORTS = '22',\n            DNS_PORTS = '53'\n        }\n    }\n}\n\n-- Alert output\nalert_fast = {\n    file = true,\n    packet = false,\n    limit = 100\n}\n\n-- Unified2 output for Barnyard2\u002FSIEM integration\n-- alert_unified2 = { limit = 128 }\n\n-- JSON alert output\nalert_json = {\n    file = true,\n    limit = 100,\n    fields = 'timestamp pkt_num proto pkt_gen pkt_len dir src_addr src_port dst_addr dst_port service rule action'\n}\n\n-- Syslog output\n-- alert_syslog = { level = 'info', facility = 'local1' }\n\nLUAEOF\n```\n\n### Step 4: Download and Configure Rulesets\n\n```bash\n# Download Snort 3 Community Rules\nwget https:\u002F\u002Fwww.snort.org\u002Fdownloads\u002Fcommunity\u002Fsnort3-community-rules.tar.gz\ntar xzf snort3-community-rules.tar.gz\nsudo cp snort3-community-rules\u002Fsnort3-community.rules \u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002Frules\u002F\n\n# Install PulledPork 3 for automated rule management\ngit clone https:\u002F\u002Fgithub.com\u002Fshirkdog\u002Fpulledpork3.git\ncd pulledpork3\nsudo python3 setup.py install\n\n# Configure PulledPork\nsudo tee \u002Fusr\u002Flocal\u002Fetc\u002Fpulledpork3\u002Fpulledpork.conf \u003C\u003C 'EOF'\nregistered_ruleset = true\noinkcode = \u003CYOUR_OINK_CODE>\nsnort_path = \u002Fusr\u002Flocal\u002Fbin\u002Fsnort\nlocal_rules = \u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002Frules\u002Flocal.rules\nsorule_path = \u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002Fso_rules\u002F\nsnort_version = 3.0.0.0\nblocklist_path = \u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002Flists\u002F\npid_path = \u002Fvar\u002Frun\u002Fsnort.pid\nips_policy = balanced\nEOF\n\n# Run PulledPork to fetch and process rules\nsudo pulledpork3 -c \u002Fusr\u002Flocal\u002Fetc\u002Fpulledpork3\u002Fpulledpork.conf\n```\n\n### Step 5: Write Custom Detection Rules\n\n```bash\n# Create local rules file\nsudo tee \u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002Frules\u002Flocal.rules \u003C\u003C 'EOF'\n# Detect reverse shell on common ports\nalert tcp $HOME_NET any -> $EXTERNAL_NET 4444 (\n    msg:\"LOCAL Possible Reverse Shell on port 4444\";\n    flow:established,to_server;\n    content:\"\u002Fbin\u002Fsh\"; nocase;\n    sid:1000001; rev:1;\n    classtype:trojan-activity;\n    priority:1;\n)\n\n# Detect Mimikatz execution indicators over SMB\nalert tcp any any -> $HOME_NET 445 (\n    msg:\"LOCAL Mimikatz Lateral Movement via SMB\";\n    flow:established,to_server;\n    content:\"|FF|SMB\";\n    content:\"mimikatz\"; nocase; distance:0;\n    sid:1000002; rev:1;\n    classtype:trojan-activity;\n    priority:1;\n)\n\n# Detect DNS tunneling (high-entropy long subdomain queries)\nalert udp $HOME_NET any -> any 53 (\n    msg:\"LOCAL Possible DNS Tunneling - Long Query Name\";\n    content:\"|01 00|\"; offset:2; depth:2;\n    byte_test:1,>,50,12;\n    sid:1000003; rev:1;\n    classtype:policy-violation;\n    priority:2;\n)\n\n# Detect cleartext password transmission via FTP\nalert tcp $HOME_NET any -> any 21 (\n    msg:\"LOCAL FTP Cleartext Password Detected\";\n    flow:established,to_server;\n    content:\"PASS \"; depth:5;\n    sid:1000004; rev:1;\n    classtype:policy-violation;\n    priority:2;\n)\n\n# Detect potential port scan (SYN flood pattern)\nalert tcp $EXTERNAL_NET any -> $HOME_NET any (\n    msg:\"LOCAL Possible Port Scan SYN Flood\";\n    flow:stateless;\n    flags:S,12;\n    threshold:type both, track by_src, count 100, seconds 10;\n    sid:1000005; rev:1;\n    classtype:attempted-recon;\n    priority:2;\n)\nEOF\n```\n\n### Step 6: Validate Configuration and Run\n\n```bash\n# Validate configuration\nsnort -c \u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002Fsnort.lua --daq-dir \u002Fusr\u002Flocal\u002Flib\u002Fdaq -T\n\n# Run Snort in IDS mode on the capture interface\nsudo snort -c \u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002Fsnort.lua --daq-dir \u002Fusr\u002Flocal\u002Flib\u002Fdaq \\\n  -i eth1 -l \u002Fvar\u002Flog\u002Fsnort -D\n\n# Test rules against a PCAP file\nsnort -c \u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002Fsnort.lua --daq-dir \u002Fusr\u002Flocal\u002Flib\u002Fdaq \\\n  -r test_traffic.pcap -l \u002Fvar\u002Flog\u002Fsnort\u002Ftest\u002F -A fast\n\n# Create systemd service for production deployment\nsudo tee \u002Fetc\u002Fsystemd\u002Fsystem\u002Fsnort.service \u003C\u003C 'EOF'\n[Unit]\nDescription=Snort 3 IDS\nAfter=network.target snort-iface.service\n\n[Service]\nType=simple\nExecStart=\u002Fusr\u002Flocal\u002Fbin\u002Fsnort -c \u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002Fsnort.lua --daq-dir \u002Fusr\u002Flocal\u002Flib\u002Fdaq -i eth1 -l \u002Fvar\u002Flog\u002Fsnort -D\nExecReload=\u002Fbin\u002Fkill -SIGHUP $MAINPID\nRestart=on-failure\n\n[Install]\nWantedBy=multi-user.target\nEOF\n\nsudo systemctl enable --now snort.service\n```\n\n### Step 7: Monitor Alerts and Tune Rules\n\n```bash\n# View real-time alerts\ntail -f \u002Fvar\u002Flog\u002Fsnort\u002Falert_fast.txt\n\n# Parse JSON alerts for analysis\ncat \u002Fvar\u002Flog\u002Fsnort\u002Falert_json.txt | python3 -m json.tool\n\n# Identify top triggered rules for tuning\ngrep -oP 'sid:\\d+' \u002Fvar\u002Flog\u002Fsnort\u002Falert_fast.txt | sort | uniq -c | sort -rn | head -20\n\n# Suppress noisy false-positive rules\nsudo tee -a \u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002Frules\u002Fsuppress.rules \u003C\u003C 'EOF'\nsuppress gen_id 1, sig_id 2100498, track by_src, ip 10.10.1.100\nsuppress gen_id 1, sig_id 2100366, track by_dst, ip 10.10.5.0\u002F24\nEOF\n\n# Verify rule count and performance\nsnort -c \u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002Fsnort.lua --daq-dir \u002Fusr\u002Flocal\u002Flib\u002Fdaq -T 2>&1 | grep -i \"rules loaded\"\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **IDS vs IPS** | IDS passively monitors traffic and generates alerts; IPS sits inline and can actively block or drop malicious packets in real time |\n| **Snort Rule** | Detection signature with header (action, protocol, src\u002Fdst, ports) and options (content matches, flow direction, metadata) that triggers on matching traffic |\n| **Preprocessor** | Snort component that normalizes and reassembles protocol-specific traffic before rule inspection, handling fragmentation, stream reassembly, and protocol anomalies |\n| **DAQ (Data Acquisition)** | Abstraction layer in Snort 3 that interfaces with packet capture mechanisms (AF_PACKET, PCAP, NFQ) for receiving network data |\n| **Oink Code** | Personal registration code from snort.org required to download Snort Subscriber or Registered rulesets |\n| **Threshold\u002FSuppression** | Tuning mechanisms that control alert frequency (threshold) or completely silence alerts from specific sources\u002Fdestinations (suppress) |\n\n## Tools & Systems\n\n- **Snort 3**: Open-source network intrusion detection and prevention system with Lua-based configuration and multithreaded architecture\n- **PulledPork 3**: Automated Snort rule management tool that downloads, processes, and deploys rulesets with policy-based filtering\n- **Barnyard2**: Dedicated spooler that reads Snort's unified2 binary output and writes to databases (MySQL, PostgreSQL) for SIEM integration\n- **Snorby**: Web-based Snort alert management console providing dashboards, event classification, and reporting\n- **tcpreplay**: Tool for replaying PCAP files through Snort to validate rules and test detection capabilities\n\n## Common Scenarios\n\n### Scenario: Deploying Snort IDS at a Network Perimeter for Compliance\n\n**Context**: A healthcare organization needs to deploy network IDS to meet HIPAA technical safeguard requirements. The IDS must monitor traffic between the DMZ and internal network, detect common attack patterns, and forward alerts to the existing Splunk SIEM. The network carries approximately 500 Mbps of traffic during peak hours.\n\n**Approach**:\n1. Install Snort 3 on a dedicated sensor with dual NICs -- one for monitoring (span port from core switch) and one for management\n2. Configure AF_PACKET DAQ with a 512 MB ring buffer to handle peak throughput without drops\n3. Deploy Snort Community rules plus Emerging Threats Open ruleset as baseline detection\n4. Write custom rules for organization-specific threats: detection of PHI data patterns (SSN, MRN formats) leaving the network, unauthorized access to DICOM\u002FHL7 ports, and connections to known bad IP lists\n5. Configure JSON alert output and forward to Splunk via syslog using rsyslog\n6. Run Snort against 24 hours of captured baseline traffic to identify false positives, then create suppression rules for legitimate traffic patterns\n7. Enable Snort as a systemd service with automatic restart and log rotation\n\n**Pitfalls**:\n- Deploying all available rules without tuning, overwhelming the sensor and SOC with thousands of daily false positives\n- Forgetting to disable NIC offloading, causing Snort to miss packets due to checksum errors or jumbo frames\n- Not sizing the sensor hardware for peak traffic, leading to packet drops during high-volume periods\n- Relying solely on community rules without custom rules for organization-specific threats and compliance requirements\n\n## Output Format\n\n```\n## Snort IDS Deployment Report\n\n**Sensor**: snort-sensor-01 (10.10.1.250)\n**Interface**: eth1 (span port from Core-SW1 gi0\u002F24)\n**Configuration**: \u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002Fsnort.lua\n**Ruleset**: Snort Community 3.0 + Local Rules (1,247 active rules)\n**HOME_NET**: 10.10.0.0\u002F16\n\n### Detection Summary (24-hour baseline)\n\n| Category | Alert Count | Top Rule SID |\n|----------|-------------|--------------|\n| Attempted Recon | 342 | 1:2100498 (ICMP ping) |\n| Trojan Activity | 12 | 1:1000001 (Reverse shell) |\n| Policy Violation | 87 | 1:1000004 (FTP cleartext) |\n| Web Application Attack | 23 | 1:2100654 (SQL injection) |\n\n### Tuning Actions Taken\n- Suppressed SID 2100498 for 10.10.1.100 (monitoring server legitimate ICMP)\n- Thresholded SID 1000004 to 5 alerts per source per hour\n- Added 3 custom rules for PHI exfiltration detection\n```\n","# Configuring Snort IDS for Intrusion Detection\n\n## When to Use\n\n- Deploying a network-based intrusion detection system to monitor traffic at key network boundaries\n- Writing custom Snort rules to detect organization-specific threats, attack patterns, or policy violations\n- Tuning existing rulesets to reduce false positives while maintaining detection coverage\n- Integrating Snort alerts with SIEM platforms for centralized security monitoring\n- Validating network security controls by generating test traffic and confirming detection\n\n**Do not use** as a replacement for endpoint detection, for monitoring encrypted traffic without TLS inspection, or as the sole security control without complementary defenses.\n\n## Prerequisites\n\n- Snort 3.x installed from source or package manager (`snort --version` to verify)\n- Network interface configured for promiscuous mode on a span port or network tap\n- DAQ (Data Acquisition Library) installed for packet capture integration\n- Registered Snort account for downloading Snort Subscriber (paid) or Community rulesets from snort.org\n- PulledPork 3 or similar rule management tool for automated ruleset updates\n- Sufficient CPU and memory for inline traffic inspection at line rate\n\n## Workflow\n\n### Step 1: Install and Verify Snort 3\n\n```bash\n# Install dependencies (Ubuntu\u002FDebian)\nsudo apt install -y build-essential libpcap-dev libpcre3-dev libnet1-dev \\\n  zlib1g-dev luajit hwloc libdumbnet-dev bison flex libcmocka-dev \\\n  libnetfilter-queue-dev libmnl-dev autotools-dev libluajit-5.1-dev \\\n  pkg-config cmake libhwloc-dev liblzma-dev openssl libssl-dev cpputest \\\n  libsqlite3-dev uuid-dev\n\n# Install DAQ from source\ngit clone https:\u002F\u002Fgithub.com\u002Fsnort3\u002Flibdaq.git\ncd libdaq && .\u002Fbootstrap && .\u002Fconfigure && make && sudo make install\n\n# Install Snort 3\ngit clone https:\u002F\u002Fgithub.com\u002Fsnort3\u002Fsnort3.git\ncd snort3 && .\u002Fconfigure_cmake.sh --prefix=\u002Fusr\u002Flocal\ncd build && make -j$(nproc) && sudo make install\nsudo ldconfig\n\n# Verify installation\nsnort -V\n```\n\n### Step 2: Configure Network Interfaces\n\n```bash\n# Disable offloading features that interfere with packet inspection\nsudo ethtool -K eth1 gro off lro off tso off gso off rx off tx off\n\n# Enable promiscuous mode\nsudo ip link set eth1 promisc on\n\n# Create systemd service for persistent interface configuration\nsudo tee \u002Fetc\u002Fsystemd\u002Fsystem\u002Fsnort-iface.service \u003C\u003C 'EOF'\n[Unit]\nDescription=Configure Snort capture interface\nBefore=snort.service\n\n[Service]\nType=oneshot\nExecStart=\u002Fsbin\u002Fethtool -K eth1 gro off lro off tso off gso off rx off tx off\nExecStart=\u002Fsbin\u002Fip link set eth1 promisc on\nRemainAfterExit=yes\n\n[Install]\nWantedBy=multi-user.target\nEOF\n\nsudo systemctl enable snort-iface.service\n```\n\n### Step 3: Configure Snort 3 with Lua Configuration\n\n```bash\n# Create Snort directory structure\nsudo mkdir -p \u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002F{rules,builtin_rules,lists,appid}\nsudo mkdir -p \u002Fvar\u002Flog\u002Fsnort\n\n# Edit the main Snort configuration\nsudo tee \u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002Fsnort.lua \u003C\u003C 'LUAEOF'\n-- Snort 3 Configuration\n\n-- Network variables\nHOME_NET = '10.10.0.0\u002F16'\nEXTERNAL_NET = '!$HOME_NET'\n\n-- Path variables\nRULE_PATH = '\u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002Frules'\nBUILTIN_RULE_PATH = '\u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002Fbuiltin_rules'\n\n-- Configure DAQ\ndaq = {\n    module_dirs = { '\u002Fusr\u002Flocal\u002Flib\u002Fdaq' },\n    modules = { { name = 'afpacket', variables = { 'buffer_size_mb=256' } } }\n}\n\n-- Decoder configuration\nnormalizer = { tcp = { ips = true } }\n\n-- Stream inspection\nstream = { }\nstream_tcp = { policy = 'linux', session_timeout = 180 }\nstream_udp = { session_timeout = 30 }\nstream_icmp = { }\n\n-- HTTP inspection\nhttp_inspect = { }\n\n-- DNS inspection\ndns = { }\n\n-- SSL\u002FTLS inspection\nssl = { }\n\n-- SMB inspection\ndce_smb = { }\n\n-- File identification and processing\nfile_id = { rules_file = '\u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002Ffile_magic.rules' }\n\n-- Port scan detection\nport_scan = {\n    protos = 'all',\n    scan_types = 'all',\n    memcap = 10000000\n}\n\n-- Reputation-based filtering\n-- reputation = {\n--     blacklist = RULE_PATH .. '\u002Fblocklist.rules'\n-- }\n\n-- IPS rules\nips = {\n    enable_builtin_rules = true,\n    include = RULE_PATH .. '\u002Fsnort3-community.rules',\n    variables = {\n        nets = { HOME_NET = HOME_NET, EXTERNAL_NET = EXTERNAL_NET },\n        ports = {\n            HTTP_PORTS = '80 8080 8443',\n            SSH_PORTS = '22',\n            DNS_PORTS = '53'\n        }\n    }\n}\n\n-- Alert output\nalert_fast = {\n    file = true,\n    packet = false,\n    limit = 100\n}\n\n-- Unified2 output for Barnyard2\u002FSIEM integration\n-- alert_unified2 = { limit = 128 }\n\n-- JSON alert output\nalert_json = {\n    file = true,\n    limit = 100,\n    fields = 'timestamp pkt_num proto pkt_gen pkt_len dir src_addr src_port dst_addr dst_port service rule action'\n}\n\n-- Syslog output\n-- alert_syslog = { level = 'info', facility = 'local1' }\n\nLUAEOF\n```\n\n### Step 4: Download and Configure Rulesets\n\n```bash\n# Download Snort 3 Community Rules\nwget https:\u002F\u002Fwww.snort.org\u002Fdownloads\u002Fcommunity\u002Fsnort3-community-rules.tar.gz\ntar xzf snort3-community-rules.tar.gz\nsudo cp snort3-community-rules\u002Fsnort3-community.rules \u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002Frules\u002F\n\n# Install PulledPork 3 for automated rule management\ngit clone https:\u002F\u002Fgithub.com\u002Fshirkdog\u002Fpulledpork3.git\ncd pulledpork3\nsudo python3 setup.py install\n\n# Configure PulledPork\nsudo tee \u002Fusr\u002Flocal\u002Fetc\u002Fpulledpork3\u002Fpulledpork.conf \u003C\u003C 'EOF'\nregistered_ruleset = true\noinkcode = \u003CYOUR_OINK_CODE>\nsnort_path = \u002Fusr\u002Flocal\u002Fbin\u002Fsnort\nlocal_rules = \u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002Frules\u002Flocal.rules\nsorule_path = \u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002Fso_rules\u002F\nsnort_version = 3.0.0.0\nblocklist_path = \u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002Flists\u002F\npid_path = \u002Fvar\u002Frun\u002Fsnort.pid\nips_policy = balanced\nEOF\n\n# Run PulledPork to fetch and process rules\nsudo pulledpork3 -c \u002Fusr\u002Flocal\u002Fetc\u002Fpulledpork3\u002Fpulledpork.conf\n```\n\n### Step 5: Write Custom Detection Rules\n\n```bash\n# Create local rules file\nsudo tee \u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002Frules\u002Flocal.rules \u003C\u003C 'EOF'\n# Detect reverse shell on common ports\nalert tcp $HOME_NET any -> $EXTERNAL_NET 4444 (\n    msg:\"LOCAL Possible Reverse Shell on port 4444\";\n    flow:established,to_server;\n    content:\"\u002Fbin\u002Fsh\"; nocase;\n    sid:1000001; rev:1;\n    classtype:trojan-activity;\n    priority:1;\n)\n\n# Detect Mimikatz execution indicators over SMB\nalert tcp any any -> $HOME_NET 445 (\n    msg:\"LOCAL Mimikatz Lateral Movement via SMB\";\n    flow:established,to_server;\n    content:\"|FF|SMB\";\n    content:\"mimikatz\"; nocase; distance:0;\n    sid:1000002; rev:1;\n    classtype:trojan-activity;\n    priority:1;\n)\n\n# Detect DNS tunneling (high-entropy long subdomain queries)\nalert udp $HOME_NET any -> any 53 (\n    msg:\"LOCAL Possible DNS Tunneling - Long Query Name\";\n    content:\"|01 00|\"; offset:2; depth:2;\n    byte_test:1,>,50,12;\n    sid:1000003; rev:1;\n    classtype:policy-violation;\n    priority:2;\n)\n\n# Detect cleartext password transmission via FTP\nalert tcp $HOME_NET any -> any 21 (\n    msg:\"LOCAL FTP Cleartext Password Detected\";\n    flow:established,to_server;\n    content:\"PASS \"; depth:5;\n    sid:1000004; rev:1;\n    classtype:policy-violation;\n    priority:2;\n)\n\n# Detect potential port scan (SYN flood pattern)\nalert tcp $EXTERNAL_NET any -> $HOME_NET any (\n    msg:\"LOCAL Possible Port Scan SYN Flood\";\n    flow:stateless;\n    flags:S,12;\n    threshold:type both, track by_src, count 100, seconds 10;\n    sid:1000005; rev:1;\n    classtype:attempted-recon;\n    priority:2;\n)\nEOF\n```\n\n### Step 6: Validate Configuration and Run\n\n```bash\n# Validate configuration\nsnort -c \u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002Fsnort.lua --daq-dir \u002Fusr\u002Flocal\u002Flib\u002Fdaq -T\n\n# Run Snort in IDS mode on the capture interface\nsudo snort -c \u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002Fsnort.lua --daq-dir \u002Fusr\u002Flocal\u002Flib\u002Fdaq \\\n  -i eth1 -l \u002Fvar\u002Flog\u002Fsnort -D\n\n# Test rules against a PCAP file\nsnort -c \u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002Fsnort.lua --daq-dir \u002Fusr\u002Flocal\u002Flib\u002Fdaq \\\n  -r test_traffic.pcap -l \u002Fvar\u002Flog\u002Fsnort\u002Ftest\u002F -A fast\n\n# Create systemd service for production deployment\nsudo tee \u002Fetc\u002Fsystemd\u002Fsystem\u002Fsnort.service \u003C\u003C 'EOF'\n[Unit]\nDescription=Snort 3 IDS\nAfter=network.target snort-iface.service\n\n[Service]\nType=simple\nExecStart=\u002Fusr\u002Flocal\u002Fbin\u002Fsnort -c \u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002Fsnort.lua --daq-dir \u002Fusr\u002Flocal\u002Flib\u002Fdaq -i eth1 -l \u002Fvar\u002Flog\u002Fsnort -D\nExecReload=\u002Fbin\u002Fkill -SIGHUP $MAINPID\nRestart=on-failure\n\n[Install]\nWantedBy=multi-user.target\nEOF\n\nsudo systemctl enable --now snort.service\n```\n\n### Step 7: Monitor Alerts and Tune Rules\n\n```bash\n# View real-time alerts\ntail -f \u002Fvar\u002Flog\u002Fsnort\u002Falert_fast.txt\n\n# Parse JSON alerts for analysis\ncat \u002Fvar\u002Flog\u002Fsnort\u002Falert_json.txt | python3 -m json.tool\n\n# Identify top triggered rules for tuning\ngrep -oP 'sid:\\d+' \u002Fvar\u002Flog\u002Fsnort\u002Falert_fast.txt | sort | uniq -c | sort -rn | head -20\n\n# Suppress noisy false-positive rules\nsudo tee -a \u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002Frules\u002Fsuppress.rules \u003C\u003C 'EOF'\nsuppress gen_id 1, sig_id 2100498, track by_src, ip 10.10.1.100\nsuppress gen_id 1, sig_id 2100366, track by_dst, ip 10.10.5.0\u002F24\nEOF\n\n# Verify rule count and performance\nsnort -c \u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002Fsnort.lua --daq-dir \u002Fusr\u002Flocal\u002Flib\u002Fdaq -T 2>&1 | grep -i \"rules loaded\"\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **IDS vs IPS** | IDS passively monitors traffic and generates alerts; IPS sits inline and can actively block or drop malicious packets in real time |\n| **Snort Rule** | Detection signature with header (action, protocol, src\u002Fdst, ports) and options (content matches, flow direction, metadata) that triggers on matching traffic |\n| **Preprocessor** | Snort component that normalizes and reassembles protocol-specific traffic before rule inspection, handling fragmentation, stream reassembly, and protocol anomalies |\n| **DAQ (Data Acquisition)** | Abstraction layer in Snort 3 that interfaces with packet capture mechanisms (AF_PACKET, PCAP, NFQ) for receiving network data |\n| **Oink Code** | Personal registration code from snort.org required to download Snort Subscriber or Registered rulesets |\n| **Threshold\u002FSuppression** | Tuning mechanisms that control alert frequency (threshold) or completely silence alerts from specific sources\u002Fdestinations (suppress) |\n\n## Tools & Systems\n\n- **Snort 3**: Open-source network intrusion detection and prevention system with Lua-based configuration and multithreaded architecture\n- **PulledPork 3**: Automated Snort rule management tool that downloads, processes, and deploys rulesets with policy-based filtering\n- **Barnyard2**: Dedicated spooler that reads Snort's unified2 binary output and writes to databases (MySQL, PostgreSQL) for SIEM integration\n- **Snorby**: Web-based Snort alert management console providing dashboards, event classification, and reporting\n- **tcpreplay**: Tool for replaying PCAP files through Snort to validate rules and test detection capabilities\n\n## Common Scenarios\n\n### Scenario: Deploying Snort IDS at a Network Perimeter for Compliance\n\n**Context**: A healthcare organization needs to deploy network IDS to meet HIPAA technical safeguard requirements. The IDS must monitor traffic between the DMZ and internal network, detect common attack patterns, and forward alerts to the existing Splunk SIEM. The network carries approximately 500 Mbps of traffic during peak hours.\n\n**Approach**:\n1. Install Snort 3 on a dedicated sensor with dual NICs -- one for monitoring (span port from core switch) and one for management\n2. Configure AF_PACKET DAQ with a 512 MB ring buffer to handle peak throughput without drops\n3. Deploy Snort Community rules plus Emerging Threats Open ruleset as baseline detection\n4. Write custom rules for organization-specific threats: detection of PHI data patterns (SSN, MRN formats) leaving the network, unauthorized access to DICOM\u002FHL7 ports, and connections to known bad IP lists\n5. Configure JSON alert output and forward to Splunk via syslog using rsyslog\n6. Run Snort against 24 hours of captured baseline traffic to identify false positives, then create suppression rules for legitimate traffic patterns\n7. Enable Snort as a systemd service with automatic restart and log rotation\n\n**Pitfalls**:\n- Deploying all available rules without tuning, overwhelming the sensor and SOC with thousands of daily false positives\n- Forgetting to disable NIC offloading, causing Snort to miss packets due to checksum errors or jumbo frames\n- Not sizing the sensor hardware for peak traffic, leading to packet drops during high-volume periods\n- Relying solely on community rules without custom rules for organization-specific threats and compliance requirements\n\n## Output Format\n\n```\n## Snort IDS Deployment Report\n\n**Sensor**: snort-sensor-01 (10.10.1.250)\n**Interface**: eth1 (span port from Core-SW1 gi0\u002F24)\n**Configuration**: \u002Fusr\u002Flocal\u002Fetc\u002Fsnort\u002Fsnort.lua\n**Ruleset**: Snort Community 3.0 + Local Rules (1,247 active rules)\n**HOME_NET**: 10.10.0.0\u002F16\n\n### Detection Summary (24-hour baseline)\n\n| Category | Alert Count | Top Rule SID |\n|----------|-------------|--------------|\n| Attempted Recon | 342 | 1:2100498 (ICMP ping) |\n| Trojan Activity | 12 | 1:1000001 (Reverse shell) |\n| Policy Violation | 87 | 1:1000004 (FTP cleartext) |\n| Web Application Attack | 23 | 1:2100654 (SQL injection) |\n\n### Tuning Actions Taken\n- Suppressed SID 2100498 for 10.10.1.100 (monitoring server legitimate ICMP)\n- Thresholded SID 1000004 to 5 alerts per source per hour\n- Added 3 custom rules for PHI exfiltration detection\n```\n",{"name":5,"tags":49,"author":50,"domain":41,"license":15,"version":51,"nist_csf":52,"subdomain":36,"description":57,"mitre_attack":58},[36,26,27,38,35],"mahipal","1.0",[53,54,55,56],"PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02","Installs, configures, and tunes Snort 3 intrusion detection system to monitor network traffic for malicious activity using custom and community rulesets, preprocessors, and alert output plugins on authorized network segments.\n",[59,60,61,62,63],"T1046","T1071.001","T1572","T1210","T1048","main","7925716f065257435fdb12e97f7e52842147d5ad",".claude\u002Fskills\u002Fconfiguring-snort-ids-for-intrusion-detection","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude","https:\u002F\u002Fclaude.com\u002Fclaude-code","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho","Software · Applied AI · Quantitative Modeling · Building with Claude.","2026-06-10 12:24:46",{"source":8,"skillName":5,"commands":73,"prompt":83,"zipAvailable":84},[74,77,80],{"tool":75,"command":76},"npx","npx skills add henriquescastilho\u002Fmy-claude --skill configuring-snort-ids-for-intrusion-detection",{"tool":78,"command":79},"bunx","bunx skills add henriquescastilho\u002Fmy-claude --skill configuring-snort-ids-for-intrusion-detection",{"tool":81,"command":82},"pnpm","pnpm dlx skills add henriquescastilho\u002Fmy-claude --skill configuring-snort-ids-for-intrusion-detection","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fconfiguring-snort-ids-for-intrusion-detection\u002FSKILL.md",true,[86,91,97],{"path":87,"resourceType":87,"resourceTypeDesc":88,"sizeBytes":89,"sourceHtmlUrl":90},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fconfiguring-snort-ids-for-intrusion-detection\u002FLICENSE",{"path":92,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":95,"sourceHtmlUrl":96},"references\u002Fapi-reference.md","REFERENCE","参考文档",2245,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fconfiguring-snort-ids-for-intrusion-detection\u002Freferences\u002Fapi-reference.md",{"path":98,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":101,"sourceHtmlUrl":102},"scripts\u002Fagent.py","SCRIPT","脚本",7287,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fconfiguring-snort-ids-for-intrusion-detection\u002Fscripts\u002Fagent.py",[104,145,154,163,185,211],{"skillNo":105,"name":106,"nameZh":6,"description":107,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":108,"licenseFileUrl":6,"sourceHtmlUrl":109,"categories":110,"keywords":125,"publishedAt":44},"01M6F0B6XPQ65AX2X0DWK8KT3E","markitdown","Convert files and office documents to Markdown. Supports PDF, DOCX, PPTX, XLSX, images (with OCR), audio (with transcription), HTML, CSV, JSON, XML, ZIP, YouTube URLs, EPubs and more.","MIT","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[111,114,117,120],{"categoryNo":112,"categoryName":113,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000002","文档处理",{"categoryNo":115,"categoryName":116,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":118,"categoryName":119,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000004","电子表格",{"categoryNo":121,"categoryName":122,"taxonomyType":123,"taxonomyTypeDesc":124},"01JBSEEDCAT000000000000034","行政与办公人员","PROFESSION","适用职业",[106,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144],"docx","PDF","pptx","xlsx","documents","csv","ocr","Audio","Bash","markdown","convert","read","write","edit","html","images","files","youtube","with",{"skillNo":146,"name":106,"nameZh":6,"description":107,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":108,"licenseFileUrl":6,"sourceHtmlUrl":147,"categories":148,"keywords":153,"publishedAt":44},"01M6F06SBHR9F0SDWE282Y8075","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fscientific_writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[149,150,151,152],{"categoryNo":112,"categoryName":113,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":115,"categoryName":116,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":118,"categoryName":119,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":121,"categoryName":122,"taxonomyType":123,"taxonomyTypeDesc":124},[106,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144],{"skillNo":155,"name":106,"nameZh":6,"description":107,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":108,"licenseFileUrl":6,"sourceHtmlUrl":156,"categories":157,"keywords":162,"publishedAt":44},"01M6F02D4R14EJAPBWVDF9J9VQ","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[158,159,160,161],{"categoryNo":112,"categoryName":113,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":115,"categoryName":116,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":118,"categoryName":119,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":121,"categoryName":122,"taxonomyType":123,"taxonomyTypeDesc":124},[106,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144],{"skillNo":164,"name":165,"nameZh":6,"description":166,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":108,"licenseFileUrl":6,"sourceHtmlUrl":167,"categories":168,"keywords":169,"publishedAt":44},"01M6F000KS6YB4MKS774G4R8ND","zarr-python","Chunked N-D arrays for cloud storage. Compressed arrays, parallel I\u002FO, S3\u002FGCS integration, NumPy\u002FDask\u002FXarray compatible, for large-scale scientific computing pipelines.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fzarr-python\u002FSKILL.md",[],[170,171,172,173,174,175,176,177,178,179,180,181,182,183,184],"python","zarr python","storage","integration","s3","gcs","cloud","dask","parallel","pipelines","arrays","numpy","scientific computing","scale","scientific",{"skillNo":186,"name":187,"nameZh":6,"description":188,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":108,"licenseFileUrl":6,"sourceHtmlUrl":189,"categories":190,"keywords":192,"publishedAt":44},"01M6EZZJWFXM1GR78KTW6J0DN8","what-if-oracle","Run structured What-If scenario analysis with multi-branch possibility exploration. Use this skill when the user asks speculative questions like \"what if...\", \"what would happen if...\", \"what are the possibilities\", \"explore scenarios\", \"scenario analysis\", \"possibility space\", \"what could go wrong\", \"best case \u002F worst case\", \"risk analysis\", \"contingency planning\", \"strategic options\", or any question about uncertain futures. Also trigger when the user faces a fork-in-the-road decision, wants to stress-test an idea, or needs to think through consequences before committing.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fwhat-if-oracle\u002FSKILL.md",[191],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[193,194,195,196,197,198,199,200,201,202,203,137,138,204,205,206,207,208,209,210],"oracle","what if oracle","go","run","ux","futures","analysis","explore","decision","branch","question","idea","exploration","options","stress-test","strategies","scenario","stress",{"skillNo":212,"name":213,"nameZh":6,"description":214,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":108,"licenseFileUrl":6,"sourceHtmlUrl":215,"categories":216,"keywords":227,"publishedAt":44},"01M6EZZCXAEB49RXGQCJX5E8GB","venue-templates","Access comprehensive LaTeX templates, formatting requirements, and submission guidelines for major scientific publication venues (Nature, Science, PLOS, IEEE, ACM), academic conferences (NeurIPS, ICML, CVPR, CHI), research posters, and grant proposals (NSF, NIH, DOE, DARPA). This skill should be used when preparing manuscripts for journal submission, conference papers, research posters, or grant proposals and need venue-specific formatting requirements and templates.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fvenue-templates\u002FSKILL.md",[217,220,223,224],{"categoryNo":218,"categoryName":219,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":221,"categoryName":222,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":225,"categoryName":226,"taxonomyType":123,"taxonomyTypeDesc":124},"01JBSEEDCAT000000000000036","内容创作者",[228,229,230,231,232,233,234,235,134,236,137,138,139,237,238,239,240,241,184,242],"templates","venue templates","research","guidelines","NeurIPS","ICML","LaTeX","science","access","proposals","Academic","requirements","formatting","journal","chi"]