Part 2: Data Analysis, Triage, and Incident Response
In this part, you’ll learn what to do with the data that you’ve collected, enriched, indexed, and stored through traffic and log analysis. This will be accomplished through the Malcolm suite of data collection and analysis tools, with a particular focus on Arkime along with StrangeBee’s Cortex and TheHive SOAR. You will examine the differences between intrusion detection and intrusion prevention and get your hands dirty playing with Suricata and Zeek IDSs/IPSs.
This part has the following chapters:
- Chapter 6, Traffic and Log Analysis
- Chapter 7, Intrusion Detection and Prevention Systems
- Chapter 8, Security Incident and Response