“suricata”的搜索结果

Create rules for Suricata and Snort, systems that detect suspicious network traffic, to flag port scans and reconnaissance. Combine packet patterns with connection counts, tune alert volume, and summarize scanning sources, targets, and activity.

中文简介正在准备中。当前显示英语简介。

• Create rules to detect Nmap and Masscan activity
• Monitor scanning within an internal network
• Tune alerts for authorized vulnerability scanners

Deploy Suricata to detect suspicious network traffic or block it inline. Configure protocol inspection, detection rules, and structured EVE JSON logs, then connect logs to analysis platforms and check packet drops and alert quality during operation.

中文简介正在准备中。当前显示英语简介。

• Deploying network intrusion monitoring
• Configuring inline blocking of malicious traffic
• Adding custom detection rules and reducing noisy alerts

Analyze malware network captures to investigate command-and-control traffic, data theft, and downloaded files. Use packet analysis tools to identify suspicious destinations and recurring connections, extract artifacts, and create detection rules from observed patterns.

中文简介正在准备中。当前显示英语简介。

• Analyzing malware sandbox network captures
• Investigating command-and-control traffic
• Tracing data theft and file downloads

Analyze Cobalt Strike communication profiles and Beacon payload configurations to extract request paths, headers, timing, and process injection settings. Turn these indicators into a JSON report and network detection rules for Suricata or Snort.

中文简介正在准备中。当前显示英语简介。

• Analyzing a captured Malleable C2 profile
• Extracting communication settings from a Beacon payload
• Creating Suricata or Snort detection rules

Develop network monitoring for signs that may precede ransomware encryption. Uses detection rules, linked log events, and threat intelligence to identify suspicious activity and define how alerts should be investigated, prioritized, and escalated.

中文简介正在准备中。当前显示英语简介。

• Creating detection rules for activity before ransomware encryption
• Linking suspicious logins, scans, and file share access
• Investigating unusual internal network communications

Analyze DNS logs to find signs of hidden data transfers. Use query length, character randomness, traffic volume, and response sizes to identify suspicious domains and support monitoring rules with Python, Suricata, and Splunk examples.

中文简介正在准备中。当前显示英语简介。

• Investigating possible data theft through DNS traffic
• Ranking suspicious domains found in DNS logs
• Creating DNS tunneling detection rules

Analyze DNS logs for signs of hidden command traffic and data theft. Use character randomness, query timing, TXT record inspection, and machine learning to identify suspicious domains and support security monitoring rules.

中文简介正在准备中。当前显示英语简介。

• Investigating suspected DNS tunneling
• Classifying algorithmically generated domains
• Detecting periodic DNS beacon traffic

Writes and validates Suricata/Snort IDS rules for network-based malware detection, covering rule anatomy, content/pcre matching, flow and threshold options, and common mistakes that cause false positives or no matches. Activates for requests to write a Suricata rule, create Snort signatures, or build network detection rules from IOCs or C2 patterns.

中文简介正在准备中。当前显示原文说明。

Analyze Modbus industrial network traffic to identify unauthorized commands, write operations, and unusual polling intervals. Compare activity with normal traffic patterns and allowed operations, then report anomalies by type and severity.

中文简介正在准备中。当前显示英语简介。

• Investigating suspicious Modbus traffic
• Establishing normal polling patterns
• Defining allowed Modbus function codes

Deploys and configures Suricata IDS/IPS with Emerging Threats rulesets, EVE JSON logging, and custom rules for real-time network traffic inspection, threat detection, and integration with SIEM platforms for centralized security monitoring.

中文简介正在准备中。当前显示原文说明。

Deploys and configures Suricata IDS/IPS with Emerging Threats rulesets, EVE JSON logging, and custom rules for real-time network traffic inspection, threat detection, and integration with SIEM platforms for centralized security monitoring.

中文简介正在准备中。当前显示原文说明。

Deploys and configures Suricata IDS/IPS with Emerging Threats rulesets, EVE JSON logging, and custom rules for real-time network traffic inspection, threat detection, and integration with SIEM platforms for centralized security monitoring.

中文简介正在准备中。当前显示原文说明。

Analyze malware communication with command servers to understand periodic check-ins, message formats, encoded data, and backup destinations. Produces a structured analysis report and network detection rules based on captured traffic and malware code.

中文简介正在准备中。当前显示英语简介。

• Investigating malware communication in captured traffic
• Measuring periodic check-in intervals and timing variation
• Mapping command servers and backup destinations

Running Suricata against PCAPs offline and validating results via eve.json

中文简介正在准备中。当前显示原文说明。

Core building blocks of Suricata signatures and multi-condition DPI logic

中文简介正在准备中。当前显示原文说明。

Detect network reconnaissance and port scanning using Suricata and Snort IDS signatures, threshold-based detection rules, and traffic anomaly analysis to identify Nmap, Masscan, and custom scanning activity.

中文简介正在准备中。当前显示原文说明。

Detect network reconnaissance and port scanning using Suricata and Snort IDS signatures, threshold-based detection rules, and traffic anomaly analysis to identify Nmap, Masscan, and custom scanning activity.

中文简介正在准备中。当前显示原文说明。

Detect network reconnaissance and port scanning using Suricata and Snort IDS signatures, threshold-based detection rules, and traffic anomaly analysis to identify Nmap, Masscan, and custom scanning activity.

中文简介正在准备中。当前显示原文说明。

Monitor Modbus traffic in industrial control networks to identify unauthorized writes, unusual commands, and departures from normal communication. Use packet analysis and intrusion detection rules to investigate suspected controller changes and produce reports with recommended actions.

中文简介正在准备中。当前显示英语简介。

• Investigating unauthorized changes to PLC registers
• Setting up Modbus intrusion detection rules
• Checking communication patterns after a suspected compromise

Inspect DNP3 traffic, a communication protocol used in industrial control systems, for unauthorized sources and unexpected commands. The skill compares captured traffic with normal patterns and reports suspicious control actions, restarts, and file operations.

中文简介正在准备中。当前显示英语简介。

• Investigating suspicious DNP3 control commands
• Checking substation traffic against normal patterns
• Preparing DNP3 intrusion detection rules

Set up MISP to collect, store, and correlate threat intelligence from multiple feeds. Use PyMISP to automate searches and imports of indicators of compromise, such as suspicious IP addresses and file hashes, and export data for security monitoring tools.

中文简介正在准备中。当前显示英语简介。

• Collecting threat indicators from multiple feeds
• Automating MISP imports and searches
• Exporting indicators for security monitoring tools

Observe malware in an isolated Cuckoo Sandbox environment and review its processes, network traffic, and system changes. Use the findings to trace infection stages, identify persistence mechanisms, and extract indicators of compromise for behavioral reports.

中文简介正在准备中。当前显示英语简介。

• Investigating suspicious files after static analysis
• Tracing multi-stage infections and persistence mechanisms
• Extracting indicators of compromise from observed behavior

Network traffic analysis, PCAP parsing, IDS/IPS rule creation, firewall configuration auditing, and network anomaly detection

中文简介正在准备中。当前显示原文说明。

Detection engineering skill for writing, testing, and tuning Sigma, YARA, YARA-L, Suricata, Snort, Zeek, KQL, SPL, EQL, Chronicle, and Elastic detection rules. Covers ATT&CK coverage mapping, telemetry gap analysis, false-positive tuning, detection-as-code pipelines, and validation with Atomic Red Team and Caldera. Use to design durable detections backed by tests.

中文简介正在准备中。当前显示原文说明。