WEBVTT 00:00:01.660 --> 00:00:05.540 [Autogenerated] securing information is one of the toughest task I. 00:00:05.540 --> 00:00:05.750 T. 00:00:05.750 --> 00:00:07.720 Professionals have in their organizations. 00:00:08.029 --> 00:00:10.820 There are so many tools out in the world to help with this. 00:00:10.960 --> 00:00:13.700 And integrating them with each other can help increase 00:00:13.700 --> 00:00:16.270 their functionality and their usage. 00:00:17.570 --> 00:00:21.600 Many organizations have needs that go beyond the tool at times 00:00:22.070 --> 00:00:25.300 out of the box tools like snore work great. 00:00:25.730 --> 00:00:30.410 You can customize the default settings to your liking and needs but sometimes 00:00:30.540 --> 00:00:34.710 there's a specific capability that you're looking for that you need to build 00:00:34.720 --> 00:00:39.280 yourself or use another tool for integrations, 00:00:39.290 --> 00:00:45.020 APIs and plugins allow us to help streamline these use cases to make 00:00:45.020 --> 00:00:48.220 them a bit easier to get started with in the I. 00:00:48.220 --> 00:00:48.980 D s in I. 00:00:48.980 --> 00:00:49.180 P. 00:00:49.180 --> 00:00:49.330 S. 00:00:49.330 --> 00:00:53.390 Space or the group of tools that inspect traffic. 00:00:53.410 --> 00:00:58.000 There's a lot of information that's being seen and ingested sharing 00:00:58.010 --> 00:01:01.460 and using this information in effective ways is something that 00:01:01.470 --> 00:01:04.230 organizations want know something they need. 00:01:05.269 --> 00:01:07.810 We have to be able to easily have an alert, 00:01:07.810 --> 00:01:13.360 trigger response or workflow or have our sock analysts be able to 00:01:13.370 --> 00:01:17.790 add additional context information from the inspection that occurs 00:01:17.800 --> 00:01:24.740 to the data for the investigations or even just get statistics on 00:01:24.740 --> 00:01:28.570 what applications are being seen in the network in a nice visually 00:01:28.570 --> 00:01:29.480 appealing manner. 00:01:30.810 --> 00:01:31.860 Hi everyone. 00:01:32.110 --> 00:01:36.170 I'm joe Abraham and welcome to my course extensions 00:01:36.230 --> 00:01:39.210 frameworks and integrations used with Snort. 00:01:40.000 --> 00:01:43.110 I'm excited to be teaching you these capabilities and how 00:01:43.110 --> 00:01:44.880 they can be used in your environments. 00:01:45.600 --> 00:01:48.510 We'll be exploring the various options for expanding snorts 00:01:48.510 --> 00:01:51.400 capabilities and focus on a few of them. 00:01:52.380 --> 00:01:57.610 This course is all about snort and using it with tools like firewalls, 00:01:57.620 --> 00:02:01.820 sims and rule managers to see how we can better capture, 00:02:01.990 --> 00:02:04.840 share and use the data that it provides. 00:02:05.890 --> 00:02:10.449 So let's introduce the team here at Globomantics the robotics company. 00:02:11.210 --> 00:02:14.510 We're going to be working with Callie, our security engineer. 00:02:15.420 --> 00:02:18.980 She'll be setting up our snort capabilities and experimenting with 00:02:18.980 --> 00:02:21.130 the use cases that will be covered in this course. 00:02:21.860 --> 00:02:26.000 Trey is our stock analyst that will be helping her identify any 00:02:26.000 --> 00:02:28.740 specific capabilities required by the stock for this. 00:02:29.510 --> 00:02:32.730 So you know that this course is about expanding snorts capabilities 00:02:32.740 --> 00:02:35.140 but what are the topics that will be covered? 00:02:35.680 --> 00:02:36.330 Well, 00:02:36.370 --> 00:02:39.540 it'll talk about how we can expand the snort usage and 00:02:39.540 --> 00:02:41.920 capabilities in many different ways. 00:02:42.610 --> 00:02:45.370 You'll start out by learning about using Snort with 00:02:45.380 --> 00:02:47.100 open source firewalls and sims. 00:02:48.060 --> 00:02:53.070 Then you'll learn how to visualize the data Snort provides as well as 00:02:53.070 --> 00:02:57.420 see how you can better manage and optimize snort using Cisco secure 00:02:57.420 --> 00:03:03.180 firewall after the snort pre processors will be covered and you'll 00:03:03.180 --> 00:03:04.810 look at a few of them in detail. 00:03:06.080 --> 00:03:10.520 You'll learn about the snort C++ extras package and how to install 00:03:10.520 --> 00:03:15.690 and use that as well as additional plugins and how to manage this 00:03:15.790 --> 00:03:21.110 rule sets using the tool called pulled pork and no barbecue food 00:03:21.120 --> 00:03:22.680 can't manage snort rules. 00:03:22.690 --> 00:03:24.810 This is a different kind of pulled pork. 00:03:25.560 --> 00:03:28.670 Now before we get started with all the fun stuff I want to 00:03:28.670 --> 00:03:32.800 mention the Pluralsight skill path that this is a part of if 00:03:32.800 --> 00:03:35.070 you're rusty or don't know snort, 00:03:35.260 --> 00:03:38.220 I highly recommend watching other courses in this path. 00:03:39.010 --> 00:03:41.750 They will get you a nice overview of what it does, 00:03:41.830 --> 00:03:44.380 how to write rules and show you how to install it. 00:03:45.250 --> 00:03:47.850 If you want to try to follow along with this course, 00:03:47.970 --> 00:03:51.770 you'll need that start installation to be completed and have the 00:03:51.770 --> 00:03:55.270 Elastic Stack and PF sense installed in your network.