Passive Fingerprinting with Suricata скачать в хорошем качестве

Passive Fingerprinting with Suricata

Presented at SuriCon 2019 by Jeremy Grove Passive Fingerprinting using Suricata allows your Security Operations Center a greater understanding of the operating systems, devices, software and services running on your network. This process uses signatures that you control to detect and document these potential targets on a constantly running platform. The increased awareness grants the ability to improve your signal to noise ratio on alerts or be aware of the need to add in new rule sets based on the information discovered. Instead of having to spend your time determining if a device is vulnerable to a certain exploit attempted against it you will be able to reference the database created and save yourself some time. This talk will describe how we created the signatures and how we use Meer and a unique SID range to populate the database that can be referenced in the research of the IDS alerts.