PacketLab
Topic library/Suricata · IDS/IPS
Course overview

Suricata · IDS/IPS

Learn traffic visibility, detection, and inline prevention with Suricata.

16 of 16 lessons available. Each available lesson includes focused examples, key takeaways, and a quiz.

Course sections

Fundamentals3 topics
  1. Introduction to SuricataAvailable
  2. IDS versus inline IPSAvailable
  3. Sensor placement and visibilityAvailable
Sensor setup3 topics
  1. Platform and capture prerequisitesAvailable
  2. Configuration and HOME_NETAvailable
  3. Offline PCAP analysisAvailable
Rules and detection3 topics
  1. Rule anatomy and actionsAvailable
  2. Protocol and flow matchingAvailable
  3. Ruleset updates and reloadsAvailable
Alerts and investigation2 topics
  1. EVE JSON and flow correlationAvailable
  2. Alert validation and tuningAvailable
Inline prevention3 topics
  1. AF_PACKET bridge deploymentAvailable
  2. NFQUEUE routed deploymentAvailable
  3. Drop verification and failure policiesAvailable
Operations and labs2 topics
  1. Packet loss and performanceAvailable
  2. Controlled detection and prevention labAvailable