Snort is the most widely used Open Source Intrusion Detection & Prevention System and is essential in defining malicious network activity.

This module will cover the need-to-know functionalities of Snort for any security analyst: Traffic Sniffing, Traffic Logging, Traffic Blocking, PCAP investigation, and creating IDS/IPS rules. You will learn how to use Snort for different purposes and create IDS/IPS rules for different threat scenarios. By the End of the module, you will master your Snort skills and be able to detect anomalies and threats and stop malicious activities.

Snort

Learn how to use Snort to detect real-time threats, analyse recorded traffic files and identify anomalies.

Snort Challenge - The Basics

Put your snort skills into practice and write snort rules to analyse live capture network traffic.

Snort Challenge - Live Attacks

Put your snort skills into practice and defend against a live attack

Lock in what you learned with a recap. Earn points and keep your streak.

Need to know

Wireshark

Wireshark is the industry-standard tool for network protocol analysis and is essential in any kind of traffic investigation.

What are modules?

A learning pathway is made up of modules, and a module is made of bite-sized rooms (think of a room like a mini security lab).

Hierarchical diagram showing how learning pathways contain modules, which contain individual rooms.

Snort

Snort

Snort Challenge - The Basics

Snort Challenge - Live Attacks

Topic Rewind Recap