Well,
we've come to the end of this module and the Managing
Suricata Rule Sets and Rule Sources course.
We went from understanding the terms rule sets and sources all
the way through to using PCAP replays to evaluate traffic and
automating our update process with cron.
Let's go to the summary and review what we learned in this course.
We started off this course with a review of rule sets and sources in Suricata.
This included defining each term and walking through the
differences between them in a visual format.
We also took a closer look at the emerging threats rule set before
evaluating additional potential sets and sources for our server.
During this evaluation,
we took a quick look at the open‑source rule sets available on Suricata
and then selected additional sources to activate.
We leveraged suricata‑update to activate the rule sources on
our IDS and download the rule sets quickly.
Once we were able to obtain the new rules,
we evaluated the sets to detect specific threats.
We discussed one potential threat to our network and
conducted an exploit while capturing the traffic.
Then,
we used a PCAP replay technique to evaluate our captured packets against
multiple different rule sets obtained from different sources.
Finally,
we automated our future updates using a cron job configured with
a reload command to minimize interruptions.
Now that we're comfortable managing rule sets and sources,
let's check in with Globomantics on our progress.
So far in this course,
we added new rule sources to our Suricata server by
activating them with suricata‑update,
We used the same tool to obtain new rule sets from these sources
and loaded over 30,000 rules onto our server.
Once we obtained the rules,
we tested each rule set against a packet capture file that contained packets
from an exploit that we ran against our internal network.
We used PCAP replay against different rule sets and
observed the effects of adding each rule set.
Finally, we used cron to schedule regular updates on our server.
We are continuing to secure Globomantics' network and will
continue to refine our configuration throughout the Enterprise
Security Monitoring with Suricata path.
Speaking of refinement, let's discuss where you can go from here.
I would recommend continued experimentation with
rule sources and custom sources.
Evaluate the rule sets for yourself and determine which
are best suited for your environment.
Use the enable, disable, modify,
and drop configuration files to further refine your rule sets and
observe the effects with PCAP replay techniques.
While you're customizing,
learn to write your own rules and conduct tests
against them in a lab. As you learn,
continue with the Enterprise Security Monitoring with Suricata path.
For now,
I hope you enjoyed this course and you're looking forward to
continuing to build your Suricata expertise.