From the course: Network Forensics

Unlock the full course today

Join today to access over 22,600 courses taught by industry experts or purchase this course individually.

Intrusion and security events

Intrusion and security events

From the course: Network Forensics

Start my 1-month free trial

Intrusion and security events

“

- [Instructor] Examining network logs and searching for a series of related security events to detect an intrusion after a cybersecurity incident is a passive approach in network forensics. A more active way is to monitor network traffic in real time to catch attacks while they are underway. We call this more proactive method active intrusion detection. One of the well-known open source active intrusion detection system or IDS is Snort. Both Linux and Windows versions are available for installation. Once installed, Snort starts capturing packets and inspecting them for known attack data patterns which we call signatures. Snort also supports both predefined and user-defined rules. Rules rely on the protocol a packet is associated with and where it's originated from and going and are therefore different from signatures that are unique fingerprints in packets. I have Snort installed on my Linux virtual machine. Before we do anything, let's check the details of our network interface card…

Contents