Snort Intrusion Detection, Rule Writing, and PCAP Analysis

Never heard of Security Onion before, it's a great option.

instead I got a few examples and mostly videos about how to setup environments and how to view in Security Onion.

The labs are barely useful tutorials for installing Security Onion (with default configuration, don't think that it would be of help for a production deployment in any way), reading a simple pcap file from Wireshark (HTTP connection, a bunch of GET requests and one POST - only using "Follow TCP Stream" option), and writing 4 snort rules (more like one rule and 3 variations), adapted to detect the exact same connection from the pcap file.

It is useful to mention that the first lab video lasts less than 3 minutes, even when it is repeated twice (two slides explaining what Security Onion and VirtualBox is -really?).

There is no explanation about what applications are available in Security Onion, how to configure and access them, and how to manage it beyond the automatic installation and a simple 5 minute test (which also fails, by the way).

If you are attracted by the Security Onion lab... keep looking, there is nothing for you here.

Security Onion is running dreadfully slow, so much so that it unusable.

I installed Security Onion in VM Fusion, and I had to "adjust" some of the training commands to reflect the network interfaces in VM Fusion to have the Labs running.

I would recommend this to any analyst that want to learn more about PCAP, Snort, Security Onion, and malware analysis.

I was hoping for a course on writing SNORT rules.

If you can read this review, you can also read Snort rule documentation, which is what the instructor does most of the time.

To sum up, I've spent one and a half hours to learn the differences between snort rule option types, and the syntax of a snort rule.

If you want to learn about snort rules, do read the docs, they are public.

Great course, made writing Snort rules easy.

This course has given me a great overview of Intrusion Detection Systems and has helped me gain a good understanding of how to write custom Snort rules and look at PCAPs.

The course is easy to follow.

GOOD $ FOR PEOPLE NEW TO SNORT & SECURITY ONION great way to learn to monitor my network This section just seemed like reading straight from a manual I never use Snort before; real easy to follow with VirtualBox!

Instructions are easy to follow.

Need to spend time more on snort rule writing and explanation.

It does give the basic concepts of rule writing but it would be great to have the instructor show how to write rules with offsets and depth using content with bytes This was an excellent course.

An awesome tutorial on analyzing malware in packets and integrating Snort rule writing.

Professor Kurrus was very thorough in his review of Snort Rule writing and PCAP analysis.

This felt more like an overview of what SNORT can do than an actual SNORT rule writing course.

Awesome so far Good information in relation to topic.