Conventions used

There are a number of text conventions used throughout this book.

Code in text: Indicates code words in text, database table names, folder names, filenames, file extensions, pathnames, dummy URLs, user input, and Twitter handles. Here is an example: “We can see Snort detected the response from testmyids.ca (104.31.77.72) as being malicious.”

A block of code is set as follows:

sd.aler_rt			Feb 15 2021 16:46:11
sd.alert_category	NetworkAttack
sd.alert_message		NMAP Scan detecte
sd.alert_name		nmap_scan
sd.alert_number		11

When we wish to draw your attention to a particular part of a code block, the relevant lines or items are set in bold:

  <localfile>
    <location>Microsoft-Windows-Sysmon/Operational</location>
    <log_format>eventchannel</log_format>
  </localfile>

Any command-line input or output is written as follows:

idstools:
  config:
    ruleset: ‘ETOPEN’

Bold: Indicates a new term, an important word, or words that you see onscreen. For example, words in menus or dialog boxes appear in the text like this. Here is an example: “Navigate to the Home | Host | Sysmon dashboard and view the event logs at the bottom of the dashboard screen.”

Tips or important notes

Appear like this.