Securing Cisco Networks with Open Source Snort
- Code training SSFSNORT
- Duur 4 dagen
- Versie 4.0
Andere trainingsmethoden
Extra betaalopties
-
GTC’s 55 (incl. BTW)
Global Training Credits: neem contact met ons op voor meer informatie
- Cisco Learning Credits 36
Ga naar:
Methode
Deze training is in de volgende formats beschikbaar:
-
E-learning (in je eigen tempo)
Elektronisch leren in je eigen tempo
-
Klassikale training
Klassikaal leren
-
Op locatie klant
Op locatie klant
-
Virtueel leren
Virtueel leren
Vraag deze training aan in een andere lesvorm.
Trainingsbeschrijving
Naar bovenThe Securing Cisco Networks with Open Source Snort course shows you how to deploy a network intrusion detection system based on Snort. Through a combination of expert instruction and hands-on practice, you will learn how to install, configure, operate, and manage a Snort system, rules writing with an overview of basic options, advanced rules writing, how to configure PulledPork, and how to use OpenAppID to provide protection of your network from malware. You will learn techniques of tuning and performance monitoring, traffic flow through Snort rules, and more.
This course is worth 20 Continuing Education (CE) Credits
Data
Naar boven-
- Methode: Klassikale training
- Datum: 30 maart-02 april, 2026 | 9:00 AM to 5:00 PM
- Locatie: Nieuwegein (Iepenhoeve 5) (W. Europe )
- Taal: Nederlands
-
- Methode: Klassikale training
- Datum: 28 september-01 oktober, 2026 | 9:00 AM to 5:00 PM
- Locatie: Eindhoven (Evoluon Noord Brabantlaan 1) (W. Europe )
- Taal: Nederlands
Doelgroep
Naar bovenThis course is designed for technical professionals who need to know how to deploy an open source intrusion detection system (IDS) based on Snort.
Trainingsdoelstellingen
Naar bovenAfter completing this course, you should be able to:
- Describe Snort technology and identify the resources available for maintaining a Snort deployment
- Install and configure a Snort deployment
- Configure the command-line options for starting a Snort as a sniffer, a logger, and an intrusion detector, and create a script to start Snort automatically
- Identify and configure available Snort intrusion detection outputs
- Describe rule sources, updates, and utilities for managing rules and updates
- Detail the components of the snort.lua file and determine how to configure it for your deployment
- Configure Snort for inline operation using the inline-only features
- Configure rules for Snort using basic rule syntax
- Describe how traffic flows through Snort and how to optimize rules for better performance
- Configure advanced-rule options for Snort rules
- Configure OpenAppID features and functionality
- Tune Snort for efficient operation and profile system performance
Inhoud training
Naar bovenSnort Technology Introduction
- Snort Basics
- Snort Resources
Snort Installation
- Installation Prerequisites
- Performing the Snort Installation
Snort Operation Introduction
- Running Snort from the Command Line
- Configuring Snort to Start Automatically
Snort Intrusion Detection Output
- Configuring Snort Intrusion Detection Output
Rule Management
- Snort Rulesets
- PulledPork Installation and Configuration
Snort Configuration
- Examining the snort.lua File
- Inspector Configuration
Inline Operation and Configuration
- Configuring Inline Operation
- Configuring Inline-Specific Features
Snort Rule Syntax and Usage
- Basic Rule Syntax
- Common Rule Options
Snort Rule Traffic Processing Flow
- Examining Snort Traffic Flow
Advanced Rule Options
- PCRE Rule Options
- Hash Rules
- Byte Rule Options
- Implementing Flowbits
- File Detention
OpenAppID Detection Configuration
- Exploring the Open AppID Preprocessor
- Examining AppID Events and Statistics
- Detector Basics
Snort Tuning
- Viewing Performance Statistics
- Configuring Snort Rule Filters
- Implementing BPFs in Snort
- Performance Profiling
Labs
- Discovery Lab 1: Connecting to the Lab Environment
- Discovery Lab 2: Snort Installation
- Discovery Lab 3: Snort Operation
- Discovery Lab 4: Snort Intrusion Detection Output
- Discovery Lab 5: PulledPork Installation
- Discovery Lab 6: Configuring Variables
- Discovery Lab 7: Reviewing Inspector Configurations
- Discovery Lab 8: Inline Operation
- Discovery Lab 9: Basic Rule Syntax and Usage
- Discovery Lab 10: Advanced Rule Options
- Discovery Lab 11: OpenAppID Configuration
- Discovery Lab 12: Tuning Snort
Voorkennis
Naar bovenAttendees should meet the following prerequisites:
- Technical understanding of TCP/IP networking and network architecture
- Proficiency with Linux and UNIX text editing tools (vi editor is suggested but not required)
Examen
Naar bovenRecommended as preparation for exams:
- There are no exams currently aligned to this course
