Would you like to learn how to detect potential
threats to your networks using Snort?
Do you want to find out how Snort's modules and other
tools can enhance Snort's functionality?
Hello, I'm Matt Glass,
and in this course I'll be addressing all those desires and more as
we learn about Snort and some of its features.
We'll be exploring the basics of Snort, how it works,
and the different modules we can leverage within it.
We'll then explore some additional tools that you can add
on to Snort to enhance its capabilities.
This module is an overview of the course and an
introduction to the basics of Snort's operation.
Let's go to the overview and take a closer look at
what we'll cover in this module.
This course starts out with an introduction to Snort,
what it is, and what it's used for.
We'll also discuss some of the high‑level differences between
Snort version 2.0 and 3.0. The course material and labs for this
course will be based on Snort version 3.
Once we have the basics down,
we'll configure Snort to capture our first packets in the lab.
We'll also discuss the Snort configuration file and the Snort rules files.
We'll finish this module by starting Snort in IDS mode and using
some of the community and registered rules.
Throughout this module,
there will be demos of each capability where you can follow along in
your own lab environment. Before we get into those capabilities,
let's go over the scenario for this course.
In our scenario,
you're working for Globomantics, which is a large global
corporation looking to expand into new regions.
As they expand and open new office spaces,
their computer network has grown significantly.
Recent cyberattacks on other companies have them worried
that they might be the next victim.
They hired you as their security engineer and want you to
configure an intrusion detection system to detect
potential threats to their network.
You decide to use Snort as your IDS.