Blocking and Reporting Intrusion Threats

Name: Blocking and Reporting Intrusion Threats
Author: Jerry Smith

Learn how to install and configure network security tools to monitor and prevent potential security threats

Preview the first lesson free — get full access to all 4 lessons.

Course: On-Demand

Hello. My name is Jerry Smith, and in. This lesson we will introduce the Snort IDs and IPS application. If you recall, we're going to use. Pfsense as our base application and Snort. As our intrusion detection system. It's always a good idea to read. Through the documentation on any product that. You are considering installing. Fortunately, the Pfsense documentation is very informative. And easy to read. Let's look through the Snort section. To learn more, visit the URL above and select Packages, then IDs IPS and then Snort. Snort is one of the most popular. IDs and IPS tools available. It's been installed millions of times and. Currently has over 600,000 active instances running. While it can provide anomaly detection, it's. Widely known as being signature or rule. Based, and Snort is only as good as its rules. They need to be kept current against new attacks. There are several methods of updating your Snort rule set. We have snort GPL V Two and Emerging Threats. Open rules are both free with no registration required. You can subscribe to Snort Vulnerability Research. Team or VRT rules. Both require registration, but one set is free and the other is paid. With the difference being how current the rule set is. We also have the Emerging Threats Pro rules that are offered to paid subscribers. Only and typically update multiple times per week. And finally, you can create your own custom Snort rules, and we'll cover that as well. And now let's take a look at. The documentation regarding Snort alerts. After all, this is why you implement an IDs, right? As you can see, the dashboard is easy to read, with the time and. Date as the first entry. Then the Protocol involved Class gives you. An idea of what the alert is about. And then we have source IP import destination IP import followed by description. That gives you additional information about the alert. Additionally, you can download the alerts to. Your local machine for further triage. One of the most important configuration items. In Snort will be your past lists. This is a list of IP addresses that Snort will never block. By default, Snort will add its own. Interfaces to the list, but you can add items such as your vulnerability scanners. Cloud IPS, hosted email, and things of that nature. Finally, let's look at Snort blocked hosts. This is where you'll find a list of you guessed it hosts that have been blocked by Snort. Stay tuned for the next lesson, where. We will install and configure our Snort instance. Thanks for watching.

Beginner Provider : Jerry Smith 4 Lessons · 10m in Arabic, German, English, Spanish, French, Portuguese, Chinese

Course Description

PfSense is a widely used firewall platform that is easy to install and offers the ability to add additional software packages, such as Snort and Suricata. Snort and Suricata are powerful security tools that can serve as either an Intrusion Detection System (IDS) or an Intrusion Prevention System (IPS) depending on the use case for your organization. They function very similarly with the primary difference being how the rulesets are created. Implementing these technologies is straightforward with an excellent payoff in the form of better visibility into the threats your organization is facing and how to respond.

In this course on Blocking and Reporting Intrusion Threats, we will discuss how to monitor, prevent, and report possible malicious network activity. We will show you how to install Snort and Suricata, as well as discuss how to configure them to meet your security requirements. By the end of this course, you will be able to better monitor and control network security.

What You'll Learn

Understand the importance of firewall security using the PfSense firewall platform
Install Snort and Suricata as additional software packages on PfSense
Configure Snort and Suricata to meet your organization's security requirements
Describe the benefits of implementing an Intrusion Detection System (IDS) and Intrusion Prevention System (IPS)
Monitor, prevent, and report possible malicious network activity

Key Takeaways

PfSense is a widely used firewall platform that is easy to install and supports additional software packages such as Snort and Suricata.
Snort and Suricata can serve as either an Intrusion Detection System (IDS) or an Intrusion Prevention System (IPS) depending on the organization's use case.
Snort and Suricata function very similarly, with the primary difference being how their rulesets are created.
Implementing these technologies gives better visibility into the threats an organization faces and how to respond to them.
The course covers how to monitor, prevent, and report possible malicious network activity to better control network security.

Frequently Asked Questions

What does this course cover?

It covers how to monitor, prevent, and report possible malicious network activity, including how to install Snort and Suricata and configure them to meet your security requirements.

What is the difference between Snort and Suricata as taught in this course?

Snort and Suricata function very similarly and can both serve as an IDS or IPS; the primary difference is how their rulesets are created.

What firewall platform does this course use?

It uses PfSense, a widely used firewall platform that is easy to install and allows adding software packages such as Snort and Suricata.

What lessons are included in this course?

The course includes Introduction to Snort, Snort Configuration, Introduction to Suricata, and Suricata Configuration.

What skills will I gain from this course?

You will develop skills in Intrusion Detection Systems, Intrusion Detection and Prevention, Intrusion Prevention Systems, Network Security, Snort, and Threat Detection.