Product Description

The access to this course is restricted to Hakin9 Premium or IT Pack Premium Subscription

In this course, we will use the Security Onion operating system. Security Onion is based on Ubuntu Linux distro. It contains the Snort IDS, Suricata, Bro, OSSEC, Sguil, Squert, ELSA, Xplico, NetworkMiner, and many other security tools. We will use the Snort IDS application  for the majority of this blast course.

The target learning objective for this course is to introduce the student with to the Snort IDS.  We will  learn how to setup IP and Port variables for ease of management followed by being acquainted with basic Snort rules. We will then move to define our own custom rules. Finally, we will advance our learning by crafting complex Snort rules to enhance our network IDS capabilities and streamline process powers. This course is streamlined for advanced users who wish to add to their knowledge about IDS capabilities using Snort.

Self-paced

9 CPE CREDITS

---

---

What will you learn?

The student will learn different methodologies of dissecting IP packets with the Snort IDS. By doing so, it allows the student to implement granular control over what will gain or be denied access to the internal or external network.

---

What skills will you gain?

The student will learn how to effectively implement an IDS solution that preserves processing power, trim log file output to what is only necessary as well as setup log trap threshold for IDS alerts.

---

What should you know before you join?

The student needs to understand how to compute in hexadecimal format, ASCII format and binary calculations. The student also needs to be familiar with IP subnetting (both classful and classless).

---

What will you need:

• • Host workstation capable of handling at least two VM's simultaneously
  • Security Onion
    https://github.com/Security-Onion-Solutions/security-onion/wiki/Installation
  • Wire Shark
    www.wireshark.org
  • Packet Generator – (To be determined)

---

Your instructor: 

Ray holds a bachelor’s degree in computer information systems and a master’s degree in organizational leadership. His current certifications are CISSP, CEH, CCNA, N+ and the PMP. Ray freelances as an online IT instructor that includes CISSP, CEH and CCNA courses. He has also taught for various organizations on hacking with the Metasploit framework, scripting with Python and Ruby as well as other tools used for hacking. He occasionally provides IT security consultancy for various organizations. Ray resides in Augusta, Georgia USA. He has over 15 years of military and civilian IT security and project management experience.

 

---

 Course Syllabus

---

 Module 1: Getting acquainted with Snort IDS

In this module, we will cover the basics of Snort and what it provides to network administrators. A general overview will be provided to the students on Snort's capabilities and functions. For this course, it is recommended that the student is familiar with the functions of an IDS and IP access control lists.  There will be three tasks to complete for this module.

• • Task 1: Setup IP variables with the internal and external network.
  • Task 2: Setup Port variables with internal and external network.
  • Task 3: Setup log messages to output to a destination file for record.  

---

Module 2: Setting up basic Snort rules

This module will cover on dissecting snort rule configurations which compose of the Rule Header and the Rule Body. The Rule Header consists of an action, a Source IP and Port, direction indicator, destination IP and Port. The Rule Body consists of the security identifier. This module will consist of three tasks to complete.

• • Task 1: Setup a Snort incoming packet rule to alert the network administrator.
  • Task 2: Setup a Snort rule to drop an outgoing packet.
  • Task 3: Setup a Snort rule to alert for outbound web site request that is prohibited.
  • Task 4: Setup a Snort rule to to inspect contents of a packet in both binary and ASCII format.

---

Module 3: Configure Detect Offset (DOE) End Pointer (EP) and Byte Offset

In this module, we will conclude our course by setting up Snort to dissect packets by using the Detect Offset End Pointer and by inspecting packets using Byte Offset. These two functions allow the Snort IDS to discriminate with precision for known threats. This allows the IDS to process packets much faster than the previous Snort Rules because of its precision capability.

• • Task 1: Dissecting an incoming packet using DOE EP with a content match.
  • Task 2: Creating Snort rule using DOE EP with distance modifier.
  • Task 3: Setup Snort Rule DOE EP with relative offset with the ending position after another DOE advancement.

---

QUESTIONS? 

If you have any questions, please contact our eLearning Manager at [email protected].