Variables

A variable is a global setting or a placeholder for information that is user- or site-specific and used by rules.

Important

Adding or changing variables requires extensive knowledge of Snort format.

Use variables to make rules behave in specific ways, which might vary from device to device. Trellix ESM has many pre-set variables, but also allows you to add custom variables. When adding a rule, these variables appear as options in the drop-down list for the field type selected in the Type field on the New Variable page.

Each variable has a default value; set some values that correspond to the specific environment of each device. Variable names cannot contain spaces; Use an underscore ( _ ) to represent spaces. To maximize device effectiveness, set the HOME_NET variable to the home network being protected by the specific device.

This table shows a list of common variables and their default values.

Variable names	Description	Default	Default description
EXTERNAL_NET	Everyone outside of the protected network	!$HOME_NET	Port 80
HOME_NET	Local protected network address space: (10.0.0.0/80)	Any	Same as HOME_NET
HTTP_PORTS	Web server ports: 80 or 80:90 for a range between 80 and 90	80	Any port except the HTTP_PORTS
HTTP_SERVE RS	Addresses of web servers: 192.168.15.4 or [192.168.15.4,172.16.61.5]	$HOME_NET	Same as HOME_NET
SHELLCODE_PORTS	Anything but web server ports	!$HTTP_PORTS	Same as HOME_NET
SMTP	Mail server addresses	$HOME_NET	Same as HOME_NET
SMTP_SERVERS	Mail server addresses	$HOME_NET	Same as HOME_NET
SQL_SERVERS	Addresses of SQL DB servers	$HOME_NET	Same as HOME_NET
TELNET_SERVERS	Addresses of telnet servers	$HOME_NET	Same as HOME_NET

You can change system variables and add, change, or delete custom variables.

Assign types to custom variables to filter rules for reporting. Types determine the field in which the variables are available when adding or changing a rule. Variable types are global, and changes appear on all policy levels.