Monitoring and Analyzing Intrusion Threats

Name: Monitoring and Analyzing Intrusion Threats
Author: Jerry Smith

Learn how to format and offload logs and implement honeypots, honeytokens, and honeynets to add an extra layer of network security

Preview the first lesson free — get full access to all 3 lessons.

Request a demo Sign in

Course: On-Demand

Hello. My name is Jerry Smith. In this lesson, we're going to learn about offloading logs. We observed alerts in the Snort and Suricata dashboards. That is not a viable solution across a security team that would give access to your IDs and IPS systems that could end up in an accidental misconfiguration. Also, it requires someone to frequently go. In check for alerts. A better solution is to offload those logs to a Syslog server, or even better, a SIM. SIM stands for Security Information and Event Management. Think of it as a log aggregator, but with an additional layer of analytics, reporting and alerting. You can have all of your devices, including PCs, servers, and your network gear, forward their logs to your SIM, which. Acts as a centralized repository of information. Rather than have to log into every device, you have a single pane of glass. This also increases security, as every analyst and Sysadmin doesn't need to log into. Each device, just the SIM. There are many to choose from. You could simply use Syslog, which is free and included in most major operating. Systems, and can be added for free to Windows. This will satisfy most regulatory compliance requirements. But it does not offer much in terms of analytics or alerting. Simply put, it's primarily a log aggregator. As far as Sims go, there are. Many to choose from, some free and. Open source, others are proprietary. Elk is a popular open source choice. And has a version just for PF sense called PF. Elk Splunk is one of the more popular proprietary Sims. You can download a limited capability version. For free for testing. While not required, Splunk also has an. Add on for Pfsense. You can view the Pfsense documentation regarding system logs for additional information. There is also a section on how to configure remote logging. Let's take a look at it. In Pfsense from the Pfsense dashboard, click. On status, then system logs. From here, click on settings. On the far right. Now scroll all the way to the bottom. Click on the checkbox next to enable remote logging. Here's where you'll enter in your configuration to offload your PF Sense logs to. Either Syslog or your SIM. Stay tuned for the next lesson where we'll learn about Honeypots. Thanks for watching.

Beginner Provider : Jerry Smith 3 Lessons · 9m in Arabic, German, English, Spanish, French, Portuguese, Chinese

Course Description

There are many tools you can use to ensure network security. Most organizations invest in a Security Information and Event Management, or SIEM, system to act as a centralized repository for their key system’s logs. This allows you to have dashboards, queries, alerts, and log storage all in one area. Honeypots can also offer an additional layer of protection in the form of data gathering. The Cybersecurity and Infrastructure Security Agency has also developed its own advanced network security system called EINSTEIN.

In this module, Monitoring and Analyzing Intrusion Threats, you will learn how to offload your Snort and Suricata logs to other systems. We will also examine the use of Honeypots as part of a security program and have an introduction to CISA’s EINSTEIN program. By the end of this course, you will have the knowledge you need to implement additional network security layers to better monitor network security threats.

What You'll Learn

Describe how to offload Suricata and Snort logs to other systems
Explain how Honeypots can improve your defensive posture as part of a security program
Explore how CISA's EINSTEIN network security program was developed
Implement additional network security layers to better monitor network security threats

Key Takeaways

A Security Information and Event Management (SIEM) system acts as a centralized repository for an organization's key system logs, providing dashboards, queries, alerts, and log storage in one area.
Honeypots can offer an additional layer of protection in the form of data gathering.
The Cybersecurity and Infrastructure Security Agency (CISA) developed its own advanced network security system called EINSTEIN.
Offloading Snort and Suricata logs to other systems supports better monitoring of network security threats.

Frequently Asked Questions

What does this course cover?

The module covers how to offload Snort and Suricata logs to other systems, the use of Honeypots as part of a security program, and an introduction to CISA's EINSTEIN program.

What skills will I gain from this course?

The course builds skills in Intrusion Detection Systems, Intrusion Detection and Prevention, Security Analysis, Snort (Intrusion Detection System), Threat Detection, and preparation relevant to GIAC Certified Intrusion Analyst.

What lessons are included?

The course includes three lessons: Offloading Logs, Honeypots, and Introduction to CISA Einstein.

What will I be able to do after completing this course?

By the end of the course you will have the knowledge needed to implement additional network security layers to better monitor network security threats.