Hello and welcome to the second course in the Enterprise
Security Monitoring with Suricata path.
Enter Suricata Rule Sets and Rule Sources.
In the previous course, Suricata: Getting Started,
we installed Suricata, captured our first packets,
and evaluated the output.
In this course,
we're going to expand our skills and discover how to
obtain and manage prewritten rule sets.
In this first module,
we're going to start with an overview of Suricata's rule sets and sources.
Let's look at the overview and see what we'll cover in this module.
We'll start with the course scenario and the lab setup that I'll
be using in each of the demos for this course,
followed by a discussion of Suricata's rule sets and sources.
We'll discuss open‑source rule sets and how Suricata
can leverage these sets and sources.
After we understand the basics,
we'll discuss Suricata rule set management and explore the
emerging Threats rule set from the previous course.
These are the foundational concepts of rule set management in Suricata.
Once we understand them,
we'll be ready for the next module where we add additional rule sources to
our IDS. Before we get into the basics of rule sets,
let's go over the scenario for this course.
In our scenario, you're working for Globomantics, which is a large
corporation looking to expand into new regions. As they expand and
open new office spaces, their computer network has grown
significantly. Recent cyber attacks on other companies have them
worried that they might be the next victim.
They hired you as their security engineer and want you to
configure an intrusion detection system to detect
potential threats to their network.
You started by installing and configuring Suricata to satisfy their goals.
Now, you want to add and modify rule sets from
available sources to improve detection.