In this lecture I will give a brief introduction about squeal and script so squeal is in an intuitive
gooey that provides access to real time events session data and roll back it captures.
It gives information about the following data types needs alerts from snort or Sakata hits alerts from
our sick I said data antigen data from rats and blogs from bro.
You can buy wood from squeal to other tools and websites for more analysis.
For example.
Transcript where an ASCII decode of the euro back at that hour will be displayed.
Wired shock where the euro packet capture file will be opened for analysis in this well known packet
analysis tool network minor which provides a tab based report of the host IP addresses DNS transactions
files emails credentials and other party facts within the cap.
Pro that performs ASCII decode and more such as decoding HP traffic Virus Total which aggregates many
anti virus products and online scan engines to check for viruses that the users own antivirus may have
missed or to fortify against any false positives Cubano or Elsa which are as items or Security Information
and Event Management applications.
And many other tools and websites squeal is efficient since it allows you to classify or categorize
events quickly or escalate them to be analyzed by a senior analyst if necessary.
It can also display alerts in real time and the event in squeal can be categorized into seven categories
and authorized route access unauthorized user access attempt an authorized access successful denial
of service attack border security practice or policy violation reconnaissance props or scans and virus
infections and we can escalate the events as we have said or classify them as in a or no further action
is needed.
If we think that they are false positives and we can add comments while categorizing events so it can
help our queries and save their time in future when working on events.
And finally you can be informed or cut to classify specific traffic automatically for a specified period
of time rather than doing that manually and we have another tool that shares the same database with
squeal that provides different interface which is squared so squared is a web application that is used
to query and view event data stored in its database and we can form.
Typically the same things as in squeal such as grabbing and and grabbing of events by voting into other
tools and websites and categorizing events.
So in this lecture I have given a brief introduction about squeal and squirt and in the next lecture
I will start explaining about how to use a squeal.