Summary

In this chapter, we provided a high-level overview of the traffic that will be running through our network and therefore our cyber defense solution. We examined several tools provided by Kali Purple that we can deploy and integrate with other tools to analyze this data, as well as manipulate it if necessary. These solutions are well known and some of them, such as Arkime, are created by private sector organizations, whereas others were created and/or assembled by government organizations. Even more fun, some government organizations will include the private sector creations within their compilations, such as Malcolm and Arkime.

We’ve learned that Arkime is a robust network data analysis tool that is designed for large organizations and organizations that are expected to experience quick and large growth. Arkime’s greatest strength is scalability. We also explored a suite of tools that was put together as a collaborative effort between American government agencies...