Hello again,
and welcome to the next module for this course where we will examine the
effects of our rule sets against unauthorized traffic.
In the previous module,
we obtained an updated rule set from emerging threats
and two new open source rule sets.
We also added a custom rule source by URL.
Now it's time to evaluate the effects of those rules against the
potentially malicious or unauthorized traffic.
Let's go to the overview and see what we'll cover in this module.
In this module,
we're going to evaluate the effects of different rule
sets when we enable each rule source.
To evaluate the effects of these rule sets,
we're going to replay captured traffic.
When we run Suricata, it captures the traffic to a packet capture or PCAP file.
If we disable the rule set,
we can capture the traffic by simulating against our
server without the rules installed.
In this module, we'll simulate one external attack on our IRC server.
After simulating the traffic,
we'll activate the appropriate rule sets and use
Suricata to replay the captured traffic.
This allows us to test effects against the same set of
traffic multiple times as we adjust our rules.
If you're ready to get started,
we'll begin with an overview of the first potential threat and
the process of capturing packets with Suricata.