Information Technology

Securing Cisco Networks with Open Source Snort (SSFSNORT) v3.0

Instructor-Led 10 Agenda

Description

Securing Cisco Networks with Open Source Snort (SSFSNORT) v3.0 is a 4-day course that shows you how to deploy Snort® in small to enterprise-scale implementations. You will learn how to install, configure, and operate Snort in Intrusion Detection System (IDS) and Intrusion Prevention System (IPS) modes. You’ll practice installing and configuring Snort, utilize additional software tools and define rules to configure and improve the Snort environment, and more. The course qualifies for 32 Cisco Continuing Education credits (CE) towards recertification. This course will help you: Learning how to implement Snort, an open-source, rule-based, intrusion detection and prevention system. Gain leading-edge skills for high-demand responsibilities focused on security.

Course Overview

Course Objective

Upon completing this course, the learner will be able to meet these overall objectives: Define the use and placement IDS/IPS components. Identify Snort features and requirements. Compile and install Snort. Define and use different modes of Snort. Install and utilize Snort supporting software.

Who Should Attend

The primary audience for this course is as follows: Security administrators Security consultants Network administrators System engineers Technical support personnel Channel partners and resellers

Module 1: Detecting Intrusions with Snort 3.0 Lesson Id 1

Module 1: Detecting Intrusions with Snort 3.0

Module 2: Sniffing the Network Lesson Id 2

Module 2: Sniffing the Network

Module 3: Architecting Nextgen Detection Lesson Id 3

Module 3: Architecting Nextgen Detection

Module 4: Choosing a Snort Platform Lesson Id 4

Module 4: Choosing a Snort Platform

Module 5: Operating Snort 3.0 Lesson Id 5

Module 5: Operating Snort 3.0

Module 6: Examining Snort 3.0 Configuration Lesson Id 6

Module 6: Examining Snort 3.0 Configuration

Module 7: Managing Snort Lesson Id 7

Module 7: Managing Snort

Module 8: Analyzing Rule Syntax and Usage Lesson Id 8

Module 8: Analyzing Rule Syntax and Usage

Module 9: Use Distributed Snort 3.0 Lesson Id 9

Module 9: Use Distributed Snort 3.0

Module 10: Examining Lua Lesson Id 10

Module 10: Examining Lua

Lesson Id	Title	Description
1	Module 1: Detecting Intrusions with Snort 3.0	History of Snort<br />IDS<br />IPS<br />IDS vs. IPS<br />Examining Attack Vectors<br />Application vs. Service Recognition
2	Module 2: Sniffing the Network	Protocol Analyzers<br />Configuring Global Preferences<br />Capture and Display Filters<br />Capturing Packets<br />Decrypting Secure Sockets Layer (SSL) Encrypted Packets
3	Module 3: Architecting Nextgen Detection	Snort 3.0 Design<br />Modular Design Support<br />Plug Holes with Plugins<br />Process Packets<br />Detect Interesting Traffic with Rules<br />Output Data
4	Module 4: Choosing a Snort Platform	Provisioning and Placing Snort<br />Installing Snort on Linux
5	Module 5: Operating Snort 3.0	Start Snort<br />Monitor the System for Intrusion Attempts<br />Define Traffic to Monitor<br />Log Intrusion Attempts<br />Actions to Take When Snort Detects an Intrusion Attempt<br />License Snort and Subscriptions
6	Module 6: Examining Snort 3.0 Configuration	Introducing Key Features<br />Configure Sensors<br />Lua Configuration Wizard
7	Module 7: Managing Snort	Pulled Pork<br />Barnyard2<br />Elasticsearch, Logstash, and Kibana (ELK)
8	Module 8: Analyzing Rule Syntax and Usage	Anatomy of Snort Rules<br />Understand Rule Headers<br />Apply Rule Options<br />Shared Object Rules<br />Optimize Rules<br />Analyze Statistics
9	Module 9: Use Distributed Snort 3.0	Design a Distributed Snort System<br />Sensor Placement<br />Sensor Hardware Requirements<br />Necessary Software<br />Snort Configuration<br />Monitor with Snort
10	Module 10: Examining Lua	Introduction to Lua<br />Get Started with Lua