<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
I know some of you are thinking about ideas for SuriCon
presentations so I thought I'd throw out some ideas off the top of
my head of things I'd be interested in hearing about. I'm not
planning on using any of these so feel free to take whatever you
want. There is overlap in these ideas but hopefully they will at
least inspire someone.<br>
<br>
<b> 1) Robust and accurate large scale testing of rule performance
on Suricata</b><br>
- latency<br>
- throughput<br>
- engine stats<br>
- ruleset stats<br>
- statistical analysis<br>
- data (pcaps) used<br>
- tools used<br>
<br>
<b>2) 10G and beyond: setting up and tweaking Suricata for high
bandwidth links</b><br>
- hardware requirements, including different price bands (e.g.
if I had $5K I'd do this, if I had $15K then this, etc.)<br>
- commodity vs specialized or custom hardware/software<br>
- OS / OS tweaks<br>
- suri tweaks<br>
- running inline without impacting the network<br>
- challenges / failures<br>
- ideally based on real-world experience<br>
<br>
<b>3) Suricata Documentation: More important than you think</b><br>
- past, present, and future of Suri documentation<br>
- the importance of documentation + vision<br>
- how to contribute<br>
- where you can contribute (areas lacking in documentation)<br>
<b><br>
</b><b>4) Leveraging Lua scripting to turn Suricata into a Ninja</b><br>
- setup/config<br>
- what you can/can't do<br>
- practical examples/war stories<br>
<br>
<b>5) Don't tell my spouse I'm in love with JSON</b><br>
- Suricata loves to output JSON<br>
- how to manage, use, and leverage this normalized data to get
the most out of what Suricata is giving.<br>
- integrating with big data solution (or medium data solution)
;)<br>
- examples/tools<br>
<br>
<b>6) nftables changed my life and it can change yours too</b><br>
- what it means for Suricata<br>
<br>
<b>7) Zero 9's: how to achieve 100% uptime</b><br>
- live ruleset reloads<br>
- how to safely be inline all the time<br>
<br>
<b>8) Running Suricata Inline</b><br>
- hardware<br>
- fail open/closed<br>
- configuration, tweaks<br>
- challenges, pitfalls<br>
<br>
<b>9) She's all that: Suricata as a Network Security Monitor</b><br>
- Suricata is touted as an IDS/IPS but it also has powerful NSM
capabilities<br>
- How to configure and leverage the sundry and often
underutilized NSM features<br>
- big data integration and use<br>
- Tool for compliance? (only if you run out of things to talk
about because compliance gets boring fast)<br>
<br>
<b>10) Suricata vs. Latest Threats and Challenges</b><br>
- exploit kits<br>
- ransomware<br>
- malicious email attachments<br>
- encrypted C2 channels<br>
<br>
-David Wharton<br>
<br>
<br>
<div class="moz-cite-prefix">On 02/01/2016 12:33 PM, Kelley Misata
wrote:<br>
</div>
<blockquote
cite="mid:CAEoU0e89n+dSY3DSBmLL2sRig1kjsi5a-rieGScBwy4oning-g@mail.gmail.com"
type="cite">
<div dir="ltr">We are excited to announce that registration for
the <b>2nd Annual Suricata User Conference</b> is now OPEN!
This year's conference is being held in historic Washington, DC
- November 9 - 11, 2016.
<div><br>
</div>
<div><b><a moz-do-not-send="true" href="http://oisfevents.net/">Registration
is now OPEN</a></b> - don't wait as space is limited!
Plus a special discount on a 2-day Suricata training for
conference attendees.</div>
<div><br>
</div>
<div><b>Call for Speakers is also now OPEN</b> - we are looking
for exciting, dynamic, passionate speakers to share their
experience and insights with the Suricata community. Send us
your proposals, including a bio about yourself, today - <a
class="moz-txt-link-abbreviated" href="mailto:info@oisf.net"><a class="moz-txt-link-abbreviated" href="mailto:info@oisf.net">info@oisf.net</a></a>.</div>
<div><br>
</div>
<div>As always, sponsors are what makes this event possible -
help us cover the cost of this community event by becoming a
sponsor today! <b><i><a moz-do-not-send="true"
href="http://oisfevents.net/#sponsor">Sponsorships</a> as
little as $250 are available.</i></b><br>
</div>
<div><br>
</div>
<div>Any questions, don't hesitate to ask... <a
class="moz-txt-link-abbreviated" href="mailto:info@oisf.net"><a class="moz-txt-link-abbreviated" href="mailto:info@oisf.net">info@oisf.net</a></a>.</div>
<div><br>
</div>
<div>Thanks for your support!</div>
<div>-The OISF Team</div>
</div>
<br>
<br>
</blockquote>
<br>
</body>
</html>