frostyripper1
52 lines
2.3 KiB
Plaintext
52 lines
2.3 KiB
Plaintext
Snort deployment modes: IDS vs IPS vs packet logging
|
|
Snort rule writing syntax and structure
|
|
Snort preprocessors for HTTP analysis and normalization
|
|
Snort port scan detection configuration
|
|
Snort rule options: content, offset, depth, distance, within
|
|
Snort flow tracking and session management
|
|
Snort output plugins: unified2, syslog, database logging
|
|
Snort PCAP replay for testing and tuning
|
|
Snort threshold and suppression configuration
|
|
Snort dynamic modules and shared object rules
|
|
Snort reputation-based blacklist filtering
|
|
Snort SSL/TLS inspection and decryption
|
|
Snort SMTP and email analysis preprocessor
|
|
Snort DNS response validation and detection
|
|
Snort FTP and Telnet protocol analysis
|
|
Snort rate-based attack detection with detection_filter
|
|
Snort rule benchmarking and performance tuning
|
|
Snort barnyard2 spooler for high-performance logging
|
|
Snort PulledPork rule management
|
|
Snort community rules versus registered rules
|
|
Snort Oinkcode registration for rule access
|
|
Snort VRT certified rule updates
|
|
Snort inline IPS mode with iptables NFQUEUE
|
|
Snort configuration file structure and directives
|
|
Snort variable definitions and dynamic variables
|
|
Snort rule header: action, protocol, IP, port, direction
|
|
Suricata vs Snort feature comparison
|
|
Suricata multi-threading and runmode configuration
|
|
Suricata YAML configuration file structure
|
|
Suricata rule format and custom signature creation
|
|
Suricata EVE JSON log output for SIEM integration
|
|
Suricata fast pattern analysis for performance
|
|
Suricata protocol detection and app-layer parsing
|
|
Suricata TLS/SSL fingerprinting and JA3 hashing
|
|
Suricata file extraction and file store configuration
|
|
Suricata flow load balancing and cluster configuration
|
|
Suricata IPS mode with NFQUEUE and AF_PACKET
|
|
Suricata Lua scripting for custom output and rules
|
|
Suricata anomaly detection with threshold config
|
|
Suricata reputation and IP blacklisting
|
|
Suricata ruleset management with suricata-update
|
|
Suricata memory profiling and performance tuning
|
|
Suricata dataset and string matching optimization
|
|
Suricata Hyperscan acceleration for pattern matching
|
|
Suricata DNP3 and Modbus ICS protocol support
|
|
Suricata HTTP/2 protocol inspection
|
|
Suricata VXLAN and tunnel detection
|
|
Suricata unix socket control for live configuration
|
|
Suricata multi-tenant configuration
|
|
Suricata PF_RING capture acceleration
|
|
Suricata Napatech hardware offload support
|