Course Information
Registration period
Year-round Recruitment
Course Level
Study Mode
Duration
2 Hour(s) 20 Minute(s)
Language
English
Taught by
Jesse K, M.S., OSCP, CEH, Security+, Linux+, Network+, CISSP
Rating
Course Overview
Learn how to write Snort rules from a real cybersecurity professional with lectures and hands-on lab exercises.
Hello everybody. My name is Jesse Kurrus, and I’ll be your professor for the duration of the Snort Intrusion Detection, Rule Writing, and PCAP Analysis course. This course will consist of written material to go over on your own pace, and labs to reinforce the concepts from the provided resources. To follow along with these labs, you'll need a VirtualBox, Security Onion, Kali Linux, and Windows 7 VMs. These are all free and open source, including the Windows 7 VM which is available free for development purposes.
This course is 100% hands-on, save for the initial introduction. Please be prepared to follow along with these labs.
The following are the hands-on labs. Please refer to the course for full descriptions:
- Lab 1: Setting up Security Onion with VirtualBox
- Lab 2: Boleto Malware Snort Rule Writing and PCAP Analysis
- Lab 3: Vetting Snort Rule Quality with Dumbpig
- Lab 4: Utilizing Offset and Depth in a Snort Rule
- Lab 5: Kali Linux Setup with VirtualBox
- Lab 6: Snort Rule Writing (SSH and FTP)
- Lab 7: Windows 7 Eternalblue Vulnerable VM VirtualBox Setup
- Lab 8: Windows 7 Eternalblue Exploitation and Snort/PCAP Analysis
- Lab 9: Eternalblue PCAP Analysis and Snort Rule Writing
- Lab 10: Ubuntu Server 12.04 Vulnerable VM VirtualBox Setup
- Lab 11: Ubuntu Server 12.04 Heartbleed Exploitation and Snort/PCAP Analysis
- Lab 12: Heartbleed PCAP Analysis and Snort Rule Writing
Course Content
- 2 section(s)
- 14 lecture(s)
- Section 1 Lectures
- Section 2 Hands-on Labs
What You’ll Learn
- Write Snort Rules, Analyze PCAPS using Wireshark and Tcpdump, Create Virtual Machines using VirtualBox, Configure Security Onion, Test Snort rules using automated scripts, Analyze Snort NIDS alerts using Squert, Configure Kali Linux, Test exploits and analyze resulting network traffic
Skills covered in this course
Reviews
-
RReza Rahnama
No explanation on how to set up security onion, seems like bit outdated also
-
MMike Emerson
This is like studying in an encyclopedia. No instructions, no explanations, just rambling the detail of each command. Need to EXPLAIN these things and not just ramble ever onward.
-
WWaheed Rahuman
Fantastic course. I recommend this course for any one like to start in IDS. Simple and neat explanation.
-
RRobert Preston Barker
This course is a little fast-paced never wrote a rule before which is why i signed up for this course and i had to look up the breakdown of how to make rules from elsewhere. but i got allot out of this course still and would recommend it to those who are new in this field.
