Suricata: An Operator's Guide

Greetings!

Originally, this work was going to be strictly focused on Suricata, the open-source Network Intrusion Detection/Prevention System. But as I continued to write, I started to realize that it doesn't really do readers any good to know how to write effective Suricata rules, if they are not capable of doing the research to find the threats they want to detect! So I've also included several chapters and scenario exercises dedicated to threat hunting, vulnerability research, and how that ties into not just being a good, but a GREAT security analyst!

This book is still a work in progress and currently consists of 10 completed chapters. As time progresses, I will be publishing new iterations of this work with more chapters. Here are my completed chapters:

· NIDS and IDS Evasion history, its influence on design for both Snort and Suricata

· Setting up a rule writing environment

· Understanding the importance of IDS/IPS sensor placement

· Introduction to Rule Anatomy

· Measuring Rule Performance

· Threat Hunting and the Pyramid of Pain

· Threat Hunting Scenarios/Exercises (Three in total)

· Exploit Analysis and Reproduction (Including three scenarios/exercises)

· Threat Hunting and Exploit Reproduction Exercises Wrap-Up Chapter

· Encrypted Traffic (and how to handle it)

And These are the chapters I have left to complete:

· Suricata False Positive and Alert Fatigue Reduction Techniques

· Special Secret Lessons Learned from a Lifetime of Detection Engineering Chapter

As work progresses and I gain feedback from readers I may include additional chapters, or discuss additional topics. Thank you very much for your feedback and patronage.