Taking Action Against Intrusion

Name: Taking Action Against Intrusion
Author: Jerry Smith

Learn how to configure security alerts in the event of an attack

Preview the first lesson free — get full access to all 4 lessons.

Course: On-Demand

Hello. My name is Jerry Smith. In this lesson, we're going to learn about Suricata alerting. All right, let's take a look at some of the alerts. I've let the Suricata instance run for a while, so there should be some. Good information in there. I also happen to have another virtual. Machine running debian and Nmap that I use to generate some traffic that will fire alerts. Let's pause for a second. Talk about Nmap. Nmap is an open source tool for network exploration. It stands for Network Mapper. It is a primary tool and one. Of the first used during pen testing. And thus for adversaries as well. It can be run from a command. Line or the GUI version. Zenmap has the same functionality. The default settings on downloading alerts works okay, but there's a method that formats. The log file a bit better. Let's check that out. First we go to interfaces. Then click edit. Under Wan settings. Scroll down to the Eve output settings. I've already enabled this, but you'll select the Eve JSON log. And be sure. The output type is set to file. Scroll down. And hit save. One item of note you will need. To restart the Suricata service by clicking on the curved arrow. For the change to take effect, click on Interfaces. Click on that curved arrow. That will restart the instance. Now let's check out some alerts. As you can see, there are quite. A few to choose from. Most of these are just noise coming from my network. But let's look at each column heading. First you have the time and date. Then you have the action. Currently, it's set to alert. The priority on this one is three. Priority is set in ascending order, so. The most severe is a one. Next you have the protocol and the class or type of rule. Source IP, source port, destination IP destination port and then GID and Sid. A Sid is a signature ID. Every rule or signature has a unique. Identifier called a Sid. A GID is a group Identifier. Signatures that are similar are logically grouped. And assigned a GID or group ID. And lastly, you have description of the rule itself. You will also notice some icons on these alerts. The magnifying glass attempts to resolve the. DNS name of the IP address. The globe attempts to give a geolocation. Address of the IP. As you can see, this one is. In Boca Raton, Florida. You will also notice various plus signs throughout the alert. If the plus sign is under the. Source IP, it will suppress the alert. If it fires with that source IP, same for Destination. If you hit the plus sign under Git and Sid, it will suppress the alert completely. Now let's click on Logs, view from. The top menu. From the log file. To view, click the drop down and choose Eve JSON. Below you can see the log contents. From here you can copy and paste. Into Notepad or a spreadsheet to send. To a security analyst for further analysis. Here I've pasted the log file into. A spreadsheet and performed some minor cleanup. To make it more readable. You can try this as well. Stay tuned for the next lesson where. We will learn about snort alerting. Thanks for watching. Bye.

Beginner Provider : Jerry Smith 4 Lessons · 15m in Arabic, German, English, Spanish, French, Portuguese, Chinese

Course Description

To ensure the best network security possible, it is important that you analyze the alerts generated by your IDS/IPS technologies. Not only are you searching for threats and active attacks, but also for false positives, which is why building an allow list is a vital part of your network security. While most security typically focuses on using subscription rulesets, there is a definite need for custom rules. There will be situations where the threat of an attack is both imminent and well-known, but the rule hasn’t been made public.

In this course on Taking Action Against Intrusion, we will discuss how you can configure your IDS and IPS to produce alerts when faced with security threats. We will explain how to configure and triage the alerts generated by both Snort and Suricata. We will also discuss how you can create custom rules, block lists, and allow lists. By the end of this course, you will be able to better respond to cyber threats in real-time.

What You'll Learn

Triage IDS/IPS alerts to distinguish real threats and active attacks from false positives
Configure Snort and Suricata to produce alerts when faced with security threats
Create allow lists and block lists in Snort and Suricata
Apply best practices for creating custom rules
Respond to cyber threats in real-time using IDS/IPS technologies

Key Takeaways

Analyzing the alerts generated by IDS/IPS technologies is important to ensuring the best network security possible.
Alert analysis searches not only for threats and active attacks but also for false positives, which is why building an allow list is a vital part of network security.
While most security typically focuses on subscription rulesets, there is a definite need for custom rules, especially when an attack is imminent and well-known but the rule has not been made public.
The course covers configuring and triaging the alerts generated by both Snort and Suricata.
By the end of the course, learners will be able to better respond to cyber threats in real-time.

Frequently Asked Questions

What will this course teach me about IDS and IPS?

It explains how to configure your IDS and IPS to produce alerts when faced with security threats, and how to configure and triage the alerts generated by both Snort and Suricata.

Does this course cover custom rules and lists?

Yes. It discusses how to create custom rules, block lists, and allow lists, and explores best practices for creating custom rules.

Which tools does the course focus on?

The course focuses on Snort and Suricata, covering alerting in both as well as block and allow listing.

What skills does this course build?

It builds skills in cyber incident response, intrusion detection systems, intrusion detection and prevention, intrusion prevention systems, Snort, and threat detection.

What will I be able to do after completing this course?

By the end of the course, you will be able to better respond to cyber threats in real-time.