SSFSNORT - Securing Cisco Networks with Open Source Snort v4.0

The Securing Cisco Networks with Open Source Snort course shows you how to deploy a network intrusion detection system based on Snort. Through a combination of expert instruction and hands-on practice, you will learn how to install, configure, operate, and manage a Snort system, rules writing with an overview of basic options, advanced rules writing, how to configure PulledPork, and how to use OpenAppID to provide protection of your network from malware. You will learn techniques of tuning and performance monitoring, traffic flow through Snort rules, and more.

This course is worth 20 Continuing Education (CE) Credits

Snort Technology Introduction

• Snort Basics
• Snort Resources

Snort Installation

• Installation Prerequisites
• Performing the Snort Installation

Snort Operation Introduction

• Running Snort from the Command Line
• Configuring Snort to Start Automatically

Snort Intrusion Detection Output

• Configuring Snort Intrusion Detection Output

Rule Management

• Snort Rulesets
• PulledPork Installation and Configuration

Snort Configuration

• Examining the snort.lua File
• Inspector Configuration

Inline Operation and Configuration

• Configuring Inline Operation
• Configuring Inline-Specific Features

Snort Rule Syntax and Usage

• Basic Rule Syntax
• Common Rule Options

Snort Rule Traffic Processing Flow

• Examining Snort Traffic Flow

Advanced Rule Options

• PCRE Rule Options
• Hash Rules
• Byte Rule Options
• Implementing Flowbits
• File Detention

OpenAppID Detection Configuration

• Exploring the Open AppID Preprocessor
• Examining AppID Events and Statistics
• Detector Basics

Snort Tuning

• Viewing Performance Statistics
• Configuring Snort Rule Filters
• Implementing BPFs in Snort
• Performance Profiling

Attendees should meet the following prerequisites:

• Technical understanding of TCP/IP networking and network architecture
• Proficiency with Linux and UNIX text editing tools (vi editor is suggested but not required)

This course is designed for technical professionals who need to know how to deploy an open source intrusion detection system (IDS) based on Snort.