pasoib3_snort_rules

# Other
alert tcp ![192.168.1.0/25,192.168.2.0/24,192.168.11.0/30,192.168.12.0/28,192.168.22.0/25] 0:65535 -> 192.168.0.1 80 (msg:"Other tried to get M/confidential data"; uricontent: "/confidential/"; offset: 0; depth: 14; flow:to_server,established; sid: 1)
alert tcp ![192.168.1.0/25,192.168.2.0/24,192.168.11.0/30,192.168.12.0/28,192.168.22.0/25] 0:65535 -> 192.168.10.1 8080 (msg:"Other tried to get F1/confidential data"; uricontent: "/confidential/"; offset: 0; depth: 14; flow:to_server,established; sid: 2)
alert tcp ![192.168.1.0/25,192.168.2.0/24,192.168.11.0/30,192.168.12.0/28,192.168.22.0/25] 0:65535 -> 192.168.0.1 80 (msg:"Other tried to get M/internal data";  uricontent: "/internal/"; offset: 0; depth: 10; flow:to_server,established; sid: 3)
alert tcp ![192.168.1.0/25,192.168.2.0/24,192.168.11.0/30,192.168.12.0/28,192.168.22.0/25] 0:65535 -> 192.168.10.1 8080 (msg:"Other tried to get F1/internal data";  uricontent: "/internal/"; offset: 0; depth: 10; flow:to_server,established; sid: 4)
alert tcp ![192.168.1.0/25,192.168.2.0/24,192.168.11.0/30,192.168.12.0/28,192.168.22.0/25] 0:65535 -> 192.168.20.1 8080 (msg:"Other tried to get F2/internal data";  uricontent: "/internal/"; offset: 0; depth: 10; flow:to_server,established; sid: 5)

# M Trusted
alert tcp 192.168.1.0/25 0:65535 -> 192.168.10.1 8080 (msg:"M Trusted tried to get F1/confidential data";  uricontent: "/confidential/"; offset: 0; depth: 14;  flow:to_server,established; sid: 6)
alert tcp 192.168.1.0/25 0:65535 -> 192.168.10.1 8080 (msg:"M Trusted tried to get F1/internal data";  uricontent: "/internal/"; offset: 0; depth: 10; flow:to_server,established; sid: 7)
alert tcp 192.168.1.0/25 0:65535 -> 192.168.20.1 8080 (msg:"M Trusted tried to get F2/internal data";  uricontent: "/internal/"; offset: 0; depth: 10; flow:to_server,established; sid: 8)

# M Regular
alert tcp 192.168.2.0/24 0:65535 -> 192.168.0.1 80 (msg:"M Regular tried to get M/confidential data";  uricontent: "/confidential/"; offset: 0; depth: 14; flow:to_server,established; sid: 9)
alert tcp 192.168.2.0/24 0:65535 -> 192.168.10.1 8080 (msg:"M Regular tried to get F1/confidential data";  uricontent: "/confidential/"; offset: 0; depth: 14; flow:to_server,established; sid: 10)
alert tcp 192.168.2.0/24 0:65535 -> 192.168.10.1 8080 (msg:"M Regular tried to get F1/internal data";  uricontent: "/internal/"; offset: 0; depth: 10; flow:to_server,established; sid: 11)
alert tcp 192.168.2.0/24 0:65535 -> 192.168.20.1 8080 (msg:"M Regular tried to get F2/internal data";  uricontent: "/internal/"; offset: 0; depth: 10; flow:to_server,established; sid: 12)

# F1 Trusted
alert tcp 192.168.11.0/30 0:65535 -> 192.168.0.1 80 (msg:"F1 Trusted tried to get M/confidential data";  uricontent: "/confidential/"; offset: 0; depth: 14; flow:to_server,established; sid: 13)
alert tcp 192.168.11.0/30 0:65535 -> 192.168.20.1 8080 (msg:"F1 Trusted tried to get F2/internal data";  uricontent: "/internal/"; offset: 0; depth: 10; flow:to_server,established; sid: 14)

# F1 Regular
alert tcp 192.168.12.0/28 0:65535 -> 192.168.0.1 80 (msg:"F1 Regular tried to get M/confidential data";  uricontent: "/confidential/"; offset: 0; depth: 14; flow:to_server,established; sid: 15)
alert tcp 192.168.12.0/28 0:65535 -> 192.168.0.1 80 (msg:"F1 Regular tried to get M/internal data";  uricontent: "/internal/"; offset: 0; depth: 10; flow:to_server,established; sid: 16)
alert tcp 192.168.12.0/28 0:65535 -> 192.168.10.1 8080 (msg:"F1 Regular tried to get F1/confidential data";  uricontent: "/confidential/"; offset: 0; depth: 14; flow:to_server,established; sid: 17)

# F2 Regular
alert tcp 192.168.22.0/25 0:65535 -> 192.168.0.1 80 (msg:"F2 Regular tried to get M/confidential data";  uricontent: "/confidential/"; offset: 0; depth: 14; flow:to_server,established; sid: 18)
alert tcp 192.168.22.0/25 0:65535 -> 192.168.10.1 8080 (msg:"F2 Regular tried to get F1/confidential data";  uricontent: "/confidential/"; offset: 0; depth: 14; flow:to_server,established; sid: 19)
alert tcp 192.168.22.0/25 0:65535 -> 192.168.0.1 80 (msg:"F2 Regular tried to get M/internal data";  uricontent: "/internal/"; offset: 0; depth: 10; flow:to_server,established; sid: 20)