Suricata: Invisible Network Traffic, Back on your Radar

Speaker: Victor Julien

Abstract

This talk will be an introduction into the open source Network Intrusion Detection System (NIDS) "Suricata". It will give an overview of Suricata's capabilities for finding malware, command and control channels and other malicious network activity. As the Suricata development is governed by a non-profit, the Open Information Security Foundation (OISF), some insight into managing an open source project for a living will also be provided. A demonstration will be given of Suricata's support for ELK (Elasticsearch, Logstash, Kibana), and how this can be used to gain more insight into the network.

Slides: PDF

Biography

Victor has been active as a software developer in the infosec community for many years. He is the creator of the Vuurmuur firewall project and has been one of the developers at the Snort_inline IPS project. Victor has spent the last years doing contract development on Open Source security software including significant additions to Snort. At the end of 2007 he started development on the OISF codebase on which he now leads the development effort. Victor maintains a blog at http://www.inliniac.net/blog/ and uses Twitter at http://twitter.com/inliniac. Victor resides in Amsterdam, The Netherlands.