Welcome, everyone, to Network Security Monitoring with Suricata.
This training is brought to you by the Open Information Security Foundation,
the U.S.
nonprofit organization that for the past 11 years has guided and
managed the open source project and its community,
Suricata.
This will be a short section to provide you with an introduction to the course,
discuss how it is structured,
and get you hands‑on with everything you need to be successful.
First and foremost, what are the goals of this course?
Well,
this course is designed to provide you with all of the basic knowledge
and instructions to get started working with Suricata,
so that you can maximize its use in your networks.
While we say this is a basic course,
we will cover many key fundamental topics that are crucial to
understand when deploying Suricata for the first time,
expanding an existing deployment,
or ensuring that you are maximizing the
infrastructure you already have in place.
There are many topics that we can go into much more detail,
and we hope you consider joining us at one of our in‑person
or virtual deep dive training events.
You can find more information at suricata.io/learn.
So what can you expect from this course?
This is a 100% virtual, asynchronous learning experience,
which simply means you move through the course at your own pace.
This allows you to go back through content you've already completed,
in case you need to focus in on a specific area.
This course is broken down into sections which contain a series of videos.
Each section is focused on an important aspect of working with Suricata and
will provide a combination of content‑based instructions and demonstrations
that you will be able to follow along with.
We will also use a variety of traffic sources to explore Suricata,
most of which comes from working with real‑world malware.
Many sections will also contain labs complete with guides.
This is to help ensure that you've gained proficiency
with the topics covered in that section.
We will also utilize end‑of‑section quizzes to help ensure
that the key learning objectives were met.
But don't worry, these won't be onerous or time consuming,
but rather a quick way to help ensure you're ready to move on.
What happens when you need help?
Don't hesitate to reach out.
The learning software provides a discussion feature along with each section.
We'll watch that closely and strive to respond in a timely manner.
Please feel free to also contact us through email at training@oisf.net,
as well as to seek help outside of the course content at our forums.
As I mentioned, this course is designed around sections,
so let's go through what sections you'll expect throughout this course.
Each section contains a variety of videos,
demonstrations that provide ample hands‑on
activities and other relevant resources.
This first section is short.
In fact, it's one of the shortest of the course.
In the rest of this section,
it will include a discussion around the basics of intrusion
detection and prevention and then a demonstration
introducing you to the training VM,
which we'll use throughout the remainder of the course.
Section 2 will get you started with Suricata basics,
we'll get more in depth with the training VM,
look at common Suricata operations,
and start exploring rule management with suricate‑update.
Section 3 will continue to build your Suricata core knowledge and
explore such topics as generating and triaging alerts,
working directly with Suricata's data output through the EVE.JSON file,
and exploring more advanced Suricata configuration options.
By the end of this section,
you'll have a solid foundation of knowing what Suricata can do,
how to manage it, and get hands‑on with rules.
Section 4 is all about Suricata deployments,
and we'll focus on deployment modes, network placement and capture methods,
and more advanced usage of suricate‑update.
We will also discuss how to integrate Suricata into your
security stack through the use of Filebeat,
which is a key component of an Elastic Stack‑based setup.
We'll wrap up this section by looking into Suricata's file
identification and extraction capabilities.
The final section will be a wrap‑up,
provide an end of course assessment to confirm your skills, and
provide advice and guidance for next steps.
This will also be a short section.
Finally,
we'd like to point out a few more resources that are
good to know going into this course.
Suricata's primary documentation is available at readthedocs, and
provides an extensive amount of information. While we've tried to make
this training as complete as possible, there are likely things we will
either miss or, due to time constraints,
not be able to cover.
The docs are a great place to go to not only help fill in any of these
gaps but also to continue to learn about Suricata.
All of the software we will use is freely available under an open source
license, and you can visit some of the project pages listed here to
learn more about these individual projects.
Again, welcome to the course.
We're excited to have you here.
Let's now turn our attention to some of the basics.