Traffic and Log Analysis

Now that we’ve established a bare-bones SIEM solution and learned how to direct traffic to that solution, it’s time to see how Kali Purple can help us understand the traffic that we’re sending. Otherwise, it wouldn’t do much good to send the traffic if we couldn’t make much sense of it, right? Kali Purple provides some well-known solutions that each approach traffic analysis in different ways. The two we will highlight are Arkime, formerly known as Moloch, and Malcolm, previously known as Bro.

Additionally, we are going to peek at how bad actors will sometimes intentionally manipulate this traffic to fool cyberdefense systems and personnel. Even the most experienced and knowledgeable personnel and systems can be slowed down by making the traffic hard to understand through a concept known as obfuscation. Well-trained bad actors know that obfuscation won’t fool properly trained and/or experienced defense analysts but...