Network Security Monitoring with Suricata
Sophisticated adversaries have routinely demonstrated the ability to compromise enterprise networks and remain hidden for extended periods of time. This course will teach you how to dig deep into network traffic utilizing Suricata.
What you'll learn
Closing the gap between when an infection occurs and when it is detected is a key goal of any security program. In this course, Network Security Monitoring with Suricata, you will gain the experience needed to get started monitoring your network with Suricata. First, you’ll explore the basics of intrusion detection and prevention. Next, you’ll discover the basics of network security monitoring and the role Suricata plays. With a solid understanding of Suricata, you will next learn about Suricata’s core functions. Finally, you will learn how to deploy Suricata into an enterprise environment. When you’re finished with this course, you’ll have the skills and knowledge of network security monitoring needed to deploy Suricata into your own networks.
This course assumes access to the Pluralsight lab environment to complete the exercises. Should you not have access to Pluralsight labs a virtual machine image is available for download, however, some details may differ from the Pluralsight lab environment. Information on how to download the virtual machine image can be found in the exercise files.
Table of contents
- Deployment Modes 12m
- Network Placement and Capture Methods 8m
- Modifying Rules with Suricata-Update 4m
- Demo: Working with modify.conf 2m
- Integrating Suricata into Your Security Stack 2m
- Demo: Shipping Suricata Logs with Filebeat 7m
- Working with Files on the Wire 4m
- Demo: Extracting Portable Executable (PE) Files 5m