2-Day Suricata Intrusion Analysis & Threat Hunting Training (SuriCon2023)

The Open Information Security Foundation (OISF) is a team of multi-national software developers and security experts committed to open source security technologies andidentifying groundbreaking trends in information security and network monitoring.OISF,a 501(c)3 non-profit organization,owns and supports Suricata. To learn more about the community or becoming a consortium member contact us atinfo@oisf.net

OISF

Eager to learn or refine your Suricata skills? Want to hear what's new in Suricata 7? Join our final 2-day training of 2023!

Sjöfartshuset Festvåning Stockholm

Suricata is a fundamental part of any security monitoring stack by way of providing and enhancing network security visibility, detection, and organizations&#x27; security policies audit. Suricata provides multiple types of data such as alerts, flows, file transactions, anomaly and network protocol logs, on top of file extraction and pcap logging. As such, it is widely used by many big and small organizations around the world, both on-prem and in the cloud.In today’s threat landscape, sophisticated adversaries have routinely demonstrated the ability to compromise enterprise networks and remain hidden for extended periods of time. This is also done in a lot of cases with the help of abusing public infrastructure services. In our Network Intrusion Analysis and Threat Hunting with Open Source Tools training, you will learn how to dig deep into network traffic to identify key evidence that a compromise has occurred, learn how to deal with new forms of attack, and develop the necessary skills to proactively search for evidence of new breaches. We will explore all phases of adversary tactics and techniques - from delivery mechanisms to post-infection traffic and data exfiltration to get hands-on analysis experience. Open-source tools such as Suricata, Arkime, and Kibana will be utilized to generate data, perform exhaustive traffic analysis, and develop comprehensive threat-hunting strategies. By the end of this course, you will have the knowledge and skills necessary to discover new threats in your network and build an effective threat-hunting program.A sample of the topics that will be covered:<ul><li>Strategies for network security architecture and visibility</li><li>Concepts of successful security deployments</li><li>Cases of Do’s and Dont’s during deployment and hunting</li><li>Data and structure of Suricata EVE logs</li><li>Use cases in Suricata 7, both in terms of detection and deployment - protocols, rule keywords, conditional pcap logging, and other new features</li><li>How to use the data generated from Suricata effectively</li><li>Fundamentals of rule writing and rule comprehension</li><li>How to manage rule sources and create effective rule sets</li><li>Where to find exact reproducible cases of signature keywords&#x27; usage</li><li>Traffic anomalies</li><li>Real and recent malware traffic generated from APT tools, Loaders, Stealers, and others</li><li>Free sources of real malware network traffic</li><li>How to pivot with off Suricata data in structured and unstructured hunts</li><li>Differences between leveraging rules such as IoC match, pattern match, and more stateful protocol logs logic detection</li><li>Different usage techniques for hunting - rules vs. Kibana / Splunk queries over network protocol (NSM) data</li><li>Lateral detection techniques in Windows environments (SMB/DCERPC)</li></ul>Added benefit for joining us:Exclusive to SuriCon2023 Suricata training attendees: Join OISF as we live stream select SuriCon talks on November 7-9, 2023. No registration required – just inform us if you&#x27;ll stay so we can reserve your seat.What is Suricata?Suricata is a high-performance, open-source network analysis and threat detection software used by most private and public organizations, and embedded by major vendors to protect their assets, developed by the Open Information Security Foundation (OISF). OISF’s mission is to remain on the leading edge of open-source IDS/IPS/NSM development by welcoming in open-source technologies looking for a community to support them.Who should attend?<ul><li>Security Administrators</li><li>Security Engineers</li><li>Security Architects</li><li>Enterprise Defenders</li><li>Incident Responders</li><li>Security Operations Specialists</li><li>Security Analysts</li><li>Malware Analysts</li></ul>Pre-requisites:<ul><li>Being able to import and run a VM (minimum 2CPU / 8GB RAM) on your laptop</li><li>Basic understanding of IDS/IPS/NSM principles</li><li>Networking, TCP/IP</li><li>Linux (Ubuntu) hands-on familiarity</li><li>Bringing a laptop to perform the exercises proposed</li></ul>We hope to see you there!Questions?  Email us at SuriCon@oisf.net or visit <a href="https://suricon.net" target="_blank" data-msys-clicktrack="0" rel="nofollow noopener noreferrer">SuriCon2023</a>.  Net proceeds from this and all OISF&#x27;s training events go directly to funding Suricata&#x27;s development and OISF&#x27;s mission to supporting open source security technologies.  For questions about this event or about becoming a member of the OISF community please contact us at <a href="mailto:info@oisf.net" target="_blank" data-msys-clicktrack="0" rel="nofollow noopener noreferrer">info@oisf.net</a>.

Our {communityGuidelinesLink} describe the sort of content we prohibit on Eventbrite. If you suspect an event may be in violation, you can report it to us so we can investigate.

To report other categories of prohibited or illegal content, submit {link}

2-Day Suricata Intrusion Analysis & Threat Hunting Training (SuriCon2023)

More events from OISF

Discover more events from OISF, from Science & Tech to other experiences you might love.

2-Day Suricata Intrusion Analysis & Threat Hunting Training (SuriCon2023)

More events from OISF

Discover more events from OISF, from Science & Tech to other experiences you might love.

You might also like...

Browse more events with different dates, prices, and formats to find your next great experience.