Your team is evaluating the migration of an intrusion policy from Snort 2 to Snort 3 on a Secure Firewall Threat Defense device. The security lead wants a reviewable configuration source, efficient use of CPU cores, and the ability to add detection logic without rebuilding the engine. Which Snort 3 architectural change best supports those goals?
Select an answer to reveal the explanation.
Short Explanation
With Snort 3, you get reviewable Lua configuration, inspection that can spread work across CPU cores, and modular detection you can extend without rebuilding the engine. You can think of it as updating the tools in a workshop without replacing the whole shop.
Full Explanation
Snort 3’s combination of Lua-based configuration, multithreaded inspection, and modular detection supports all three goals: Lua provides a structured source you can review and maintain, multithreaded inspection can use CPU cores efficiently, and modular detection lets you extend detection logic without rebuilding the core engine. A design that assigns packet inspection to one worker may preserve deterministic ordering, but it does not distribute inspection across workers to use cores efficiently. A design that requires rebuilding and redeploying the engine to add detection modules conflicts with the requested ability to extend detection without rebuilding the core. A design with multithreaded inspection and extensible detection modules but only opaque, appliance-generated policy does not provide reviewable configuration source. Exam caveat: distinguish adding or updating rules and modules from changing the engine itself; extending detection without a core rebuild does not eliminate every deployment or policy-management step. Practical check: on the target Secure Firewall Threat Defense release, confirm the supported Snort 3 policy and configuration workflow, inspect the deployed configuration and thread settings, and verify in a controlled test that the intended detection logic can be added without rebuilding the engine.