Mark Durrett
Hi folks,
Here is your weekly Suricata and SELKS tips and tricks email. Each week we'll feature a blog article or PDF document with something we hope you'll find useful.
Before beginning any sort of threat hunt, it is important to consider the tools you are using.
This is especially true in the case of Suricata. Many people still consider Suricata to be a “legacy” intrusion detection system (IDS), but those that are more familiar with the tool know otherwise.
In fact, Suricata has evolved into an impressive tool for gathering NSM data and full protocol, file transaction, flow, and anomaly logs along with file extraction and PCAP logging.
Check out this recent blog from Peter Manev that describes the three Suricata fundamentals that must be understood before beginning a threat hunt:
https://www.stamus-networks.com/blog/suricata-threat-hunting-fundamentals
Let us know what you think.
Cheers!
Mark
| ||||||||||||||||||||||
|
