Well,
we've come to the end of this module covering the evaluation of
rule sets using the PCAP replay technique.
Let's go to the summary and review we learned so far in this course.
We started out this module by discussing the value in
capturing packets to a PCAP file.
We covered what the file is and the many uses we have for PCAP files
once we managed to capture our network traffic.
Once we had our captured packets,
we evaluated our rule sets and determined which ones would be
appropriate to activate against the PCAP file.
In our scenario,
we captured the traffic from an exploit of our UnrealIRCd
server running on the Metasploitable 2 host.
We examined the effects of adding each of our rule sets against
the captured traffic to determine which rule sets were most
effective in detecting this attack.
Over the last two modules,
we've seen how effective the suricata‑update tool can be at
automating the process of enabling rule sources and
obtaining rule sets from our server.
The only issue so far is that all these actions have been
conducted through a manual process.
In the next module,
we'll see how we can automate the rule updating process using the cron tool.
After that,
we'll wrap up the course with the course summary and
next steps. I'll see you there.