<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class=""><span class="" style="font-family: Menlo-Regular; font-size: 11px;">Leonard,</span><br class="" style="font-family: Menlo-Regular; font-size: 11px;"><br class="" style="font-family: Menlo-Regular; font-size: 11px;"><span class="" style="font-family: Menlo-Regular; font-size: 11px;">I would like to hear more about the coursework you have developed. I think this sort of material would be a very valuable addition to the Suricata training program, and could help draw more users to the project/community beyond those that have been traditionally drawn to it.</span><br class="" style="font-family: Menlo-Regular; font-size: 11px;"><br class="" style="font-family: Menlo-Regular; font-size: 11px;"><span class="" style="font-family: Menlo-Regular; font-size: 11px;">-Chris Montgomery</span></div><div class=""><br class=""></div><br class=""><div><blockquote type="cite" class=""><div class="">On May 27, 2016, at 3:12 PM, Leonard <<a href="mailto:ljacobs@netsecuris.com" class="">ljacobs@netsecuris.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">This is Leonard Jacobs. I claim the NSM topic on the twist of how to be the best cyber security analyst you can be. It is on the spin of the Cyber Security Analysis coursework I have already developed. I.e How to use Suricata to be the best cyber security analyst you can be.<br class=""><br class="">Thanks<br class=""><br class="">Sent from my iPhone<br class=""><br class=""><blockquote type="cite" class="">On May 27, 2016, at 12:00 PM, Victor Julien <<a href="mailto:lists@inliniac.net" class="">lists@inliniac.net</a>> wrote:<br class=""><br class=""><blockquote type="cite" class="">On 27-05-16 18:47, David Wharton wrote:<br class="">I know some of you are thinking about ideas for SuriCon presentations so<br class="">I thought I'd throw out some ideas off the top of my head of things I'd<br class="">be interested in hearing about. I'm not planning on using any of these<br class="">so feel free to take whatever you want. There is overlap in these ideas<br class="">but hopefully they will at least inspire someone.<br class=""><br class="">*1) Robust and accurate large scale testing of rule performance on Suricata*<br class=""> - latency<br class=""> - throughput<br class=""> - engine stats<br class=""> - ruleset stats<br class=""> - statistical analysis<br class=""> - data (pcaps) used<br class=""> - tools used<br class=""><br class="">*2) 10G and beyond: setting up and tweaking Suricata for high bandwidth<br class="">links*<br class=""> - hardware requirements, including different price bands (e.g. if I<br class="">had $5K I'd do this, if I had $15K then this, etc.)<br class=""> - commodity vs specialized or custom hardware/software<br class=""> - OS / OS tweaks<br class=""> - suri tweaks<br class=""> - running inline without impacting the network<br class=""> - challenges / failures<br class=""> - ideally based on real-world experience<br class=""><br class="">*3) Suricata Documentation: More important than you think*<br class=""> - past, present, and future of Suri documentation<br class=""> - the importance of documentation + vision<br class=""> - how to contribute<br class=""> - where you can contribute (areas lacking in documentation)<br class="">*<br class="">**4) Leveraging Lua scripting to turn Suricata into a Ninja*<br class=""> - setup/config<br class=""> - what you can/can't do<br class=""> - practical examples/war stories<br class=""><br class="">*5) Don't tell my spouse I'm in love with JSON*<br class=""> - Suricata loves to output JSON<br class=""> - how to manage, use, and leverage this normalized data to get the<br class="">most out of what Suricata is giving.<br class=""> - integrating with big data solution (or medium data solution) ;)<br class=""> - examples/tools<br class=""></blockquote><br class="">I nominate Jason for this one ;)<br class=""><br class=""><br class=""><blockquote type="cite" class="">*6) nftables changed my life and it can change yours too*<br class=""> - what it means for Suricata<br class=""><br class="">*7) Zero 9's: how to achieve 100% uptime*<br class=""> - live ruleset reloads<br class=""> - how to safely be inline all the time<br class=""><br class="">*8) Running Suricata Inline*<br class=""> - hardware<br class=""> - fail open/closed<br class=""> - configuration, tweaks<br class=""> - challenges, pitfalls<br class=""><br class="">*9) She's all that: Suricata as a Network Security Monitor*<br class=""> - Suricata is touted as an IDS/IPS but it also has powerful NSM<br class="">capabilities<br class=""> - How to configure and leverage the sundry and often underutilized<br class="">NSM features<br class=""> - big data integration and use<br class=""> - Tool for compliance? (only if you run out of things to talk about<br class="">because compliance gets boring fast)<br class=""><br class="">*10) Suricata vs. Latest Threats and Challenges*<br class=""> - exploit kits<br class=""> - ransomware<br class=""> - malicious email attachments<br class=""> - encrypted C2 channels<br class=""></blockquote><br class="">Great list David, thanks a lot.<br class=""><br class="">-- <br class="">---------------------------------------------<br class="">Victor Julien<br class=""><a href="http://www.inliniac.net/" class="">http://www.inliniac.net/</a><br class="">PGP: http://www.inliniac.net/victorjulien.asc<br class="">---------------------------------------------<br class=""><br class="">_______________________________________________<br class="">Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.org<br class="">Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/<br class="">List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users<br class="">Suricata User Conference November 9-11 in Washington, DC: http://oisfevents.net<br class=""></blockquote><br class=""><br class="">_______________________________________________<br class="">Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org" class="">oisf-users@openinfosecfoundation.org</a><br class="">Site: <a href="http://suricata-ids.org" class="">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/" class="">http://suricata-ids.org/support/</a><br class="">List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" class="">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br class="">Suricata User Conference November 9-11 in Washington, DC: <a href="http://oisfevents.net" class="">http://oisfevents.net</a></div></div></blockquote></div><br class=""></body></html>