Suricata is a high-performance Network IDS, IPS and Network Security Monitoring engine sought after around the world. Open-source and managed by a community, Suricata is a part of the non-profit foundation; the Open Information Security Foundation (OISF). OISF’s mission is to remain on the leading edge of open source IDS/IPS development by welcoming in open source technologies looking for a community to support them.

This 2-day signature development training led by Suricata's lead developers is being held the same week as SuriCon 2018 - join us for both and receive a 20% discount on this training! 

To receive your discount:

Who should come?

Attend this training if your goal is to learn expert methods and techniques for writing network signatures to efficiently detect the greatest threats facing organizations today. Attendees will gain invaluable information and knowledge including the configuration, usage, architecture, traffic analysis fundamentals, signature writing, and testing of Suricata IDS. Attendees will be given handouts to help them develop and read with IDS signatures. Lab exercises will train attendees how to analyze and interpret hostile network traffic into agile IDS rules for detecting threats, including but not limited to: Exploit Kits, Ransomware, Phishing Attacks, Malicious Documents, Crimeware Backdoors, Targeted Threats, and more. Attendees will leave the class armed with the knowledge of how to write quality IDS signatures for their environment, enhancing their organization’s ability to respond and detect threats. The class has been updated for the latest Suricata 4.0 IDS features while still retaining backward-compatibility with older Suricata versions. The class is very very hands-on with a robust workbook featuring exercise walkthroughs/explanations and a physical copy of the material presented. The class exercises feature paths for those that are brand new to writing IDS signatures and signature experts who dream in pcre.

A sample of the topics that will be covered:

• Network and Malware Analysis Fundamentals

• IDS Engine and Rule Writing Fundamentals

• Writing Signatures for DNS, HTTP, SSL/TOR

• Advanced Rule Features

• Detecting Phishing Communications, Ransomware Communications, Malicious Documents, Exploit Kit activity, Targeted Threats
  
  

Who should attend:

• Security Administrators
• Enterprise Defenders
• Incident Responders
• Security Operations Specialists
• Security Analysts
• Malware Analysts
• Network Engineers
  
  

• Being able to import and run a VM (1CPU /1-2GB RAM) on your laptop
• Basic Understanding of IDS/IPS/NSM
  
  

• Networking, TCP/IP
• Linux command line

Net proceeds from this and all OISF's training events go directly to funding Suricata's development and OISF's mission to support open source security technologies.  For questions about this event or about becoming a member of the OISF community please contact us at info@oisf.net.