Table of Contents
David J. Bianco, Contributing Author
Liam Randall, Contributing Author
Chapter 1. The Practice of Applied Network Security Monitoring
Vulnerability-Centric vs. Threat-Centric Defense
The NSM Cycle: Collection, Detection, and Analysis
Chapter 2. Planning Data Collection
The Applied Collection Framework (ACF)
Case Scenario: Online Retailer
Chapter 3. The Sensor Platform
Collecting and Analyzing Flow Data with SiLK
Collecting and Analyzing Flow Data with Argus
Session Data Storage Considerations
Chapter 5. Full Packet Capture Data
Choosing the Right FPC Collection Tool
Decreasing the FPC Data Storage Burden
Chapter 7. Detection Mechanisms, Indicators of Compromise, and Signatures
Indicators of Compromise and Signatures
Managing Indicators and Signatures
Indicator and Signature Frameworks
Chapter 8. Reputation-Based Detection
Automating Reputation-Based Detection
Chapter 9. Signature-Based Detection with Snort and Suricata
Changing IDS Engines in Security Onion
Initializing Snort and Suricata for Intrusion Detection
Configuring Snort and Suricata
Viewing Snort and Suricata Alerts
Creating Custom Detection Tools with Bro
Chapter 11. Anomaly-Based Detection with Statistical Data
Furthering Detection with Statistics
Visualizing Statistics with Gnuplot
Visualizing Statistics with Google Charts
Visualizing Statistics with Afterglow
Chapter 12. Using Canary Honeypots for Detection
Chapter 14. Friendly and Threat Intelligence
The Intelligence Cycle for NSM
Generating Friendly Intelligence
Generating Threat Intelligence
Chapter 15. The Analysis Process
Incident Morbidity and Mortality
Appendix 1. Security Onion Control Scripts
Appendix 2. Important Security Onion Files and Directories
Application Directories and Configuration Files