Differences

This shows you the differences between two versions of the page.

--- offline:wrccdc_pcaps_results [2018/05/12 23:39] – [Get an overview of flow activity] veera
+++ offline:wrccdc_pcaps_results [2018/05/12 23:41] – [Viewing IDS Alerts] veera
@@ Line 51: / Line 51: @@
 ==== Viewing IDS Alerts  ====
+Another great baseline place to start. Remember from Part-1 in addition to Trisul , we also run Suricata with ALL rules from ET-Open ruleset. The alerts generated by this give us a fairly good idea of the hygiene of the network. In this case, as you would expect there are a ton of NMAP scans, a few ETERNALBLUE and other alerts. You can use the "Search" form on the top to filter further. But right now, we have a fairly good baseline from this angle.
 {{ :offline:wrccdc1.png?direct&400 |}}