NSM: AKTUELT

Følg Sikkerhetskonferansen 2026 direkte

Du kan se Sikkerhetskonferansen 2026 direkte på nsm.no. Programmet begynner kl. 09.00 begge dager.  

https://nsm.no/kurs-og-konferanser/sikkerhetskonferansen/om-arets-konferanse-2026/folg-sikkerhetskonferansen-2026-direkte

#nsm #nsmbot

Hi everyone, and Happy Sunday. I've made great strides in my #Suricata book: Suricata: An Operator's Guide. However, there has been a nagging doubt in my mind: Is there something I'm missing? Is there some subject that I'm not covering that the #NSM Community or Suricata users would find useful?

What I've covered so far:

• A history of Suricata
• How to set up a Detection Engineering lab, with multiple virtual lab configurations to support different budgetary constraints
• How Sensor placement in different network fabric layers (Core, Distribution, Access layers, Inside perimeter, outside perimeter, cloud deployments) affect network visbility, and how different network protocols can make it difficult to track down problems (DNS recursion, WAF/Load Balancer deployments, NAT, etc.)
• Rule anatomy (rule headers vs. rule body, keyword categories
• Performance metrics and analysis
• Resources and sample exercises to help build effective threat research for detection engineering
• Resources and sample exercises to help build effective vulnerability research for detection engineering
• Invasive and non-invasive ways to analyze encrypted traffic for threats (TLS metadata vs. TLS Master Secrets Key logging vs. TLS Termination and forwarding of decrypted traffic) (Current chapter! 65% done)

Future Chapters/Subjects

• Noise/False Positive Reduction methods for Suricata
• How to write flexible Suricata rules
• Rule writing tips and tricks learned from a career as an NSM detection engineer/analyst
• Ways to extend Suricata's versatility (New and existing features)

With ALL of these subject listed as things I have covered and still want to cover, For those of you out there wanting to learn more about Suricata and hashtag #IDS and #IPS technology, what are subjects you would like to see covered in an operator's guide meant to both cover general administration of the platform, as well as #RuleWriting and #DetectionEngineering aspects?

I'm very open to input, which is why I'm asking! If you don't have an opinion, maybe you could share this with your followers to extend its reach? Thank you!

P.S. For those who want to see a draft of this work, such as it is right now up to chapter 9, visit leanpub.com/suri_operator. The book is "pay what you want", and the minimum price is set to free. After all I wouldn't ask for reviews, or for feedback on other subjects to cover, and also expect you to pay for an incomplete work.

Thanks in advance!

Tewaterlating van de Rotula

https://peertube.beeldengeluid.nl/w/hbbdM2H9FPHaC1fBHgJ3ew