Okay, maybe I'm missing something, but after trying to use Snort 3 rules in our Firepower setup for a few months... it feels unfinished?
We're trying to build better security data pipelines, and inconsistent behavior makes it hard to trust the logs. Some specific issues we've hit:
* **Rule conversion is unpredictable.** Some Snort 2 rules just don't translate cleanly, and the error messages aren't helpful. It creates a lot of manual work.
* **Performance logging is weird.** We tried to track performance impact of a new rule set, but the metrics in the UI don't match what we see in the system processes. Makes capacity planning a headache.
* **API inconsistencies.** When using the REST API to deploy updates, sometimes it accepts Snort 3 syntax, other times it defaults back to Snort 2 without clear warnings.
Example of a simple rule that caused deployment headaches:
```json
{
"ruleAction": "BLOCK",
"ruleDirection": "C2S",
"ruleProtocol": "tcp",
"ruleBody": "content:"|00 01 86 B8|"; depth:4; offset:0;"
}
```
The deployment succeeded, but the rule never fired on traffic we *know* should trigger it. Reverted to a Snort 2 style rule and it worked immediately.
Has anyone else built monitoring around this? I'm trying to pipe alerts to BigQuery for analysis, but the event variability adds so much transformation complexity in our dbt models.
Are we just configuring it wrong, or is Snort 3 integration still not ready for prime time?