Navigating IDS security monitoring

So far, we have installed Wireshark, learned about and configured a SPAN/mirror port, and installed a "passive" TAP. This has all led to this section. For those of you who are "purists" that may doubt the veracity of passive monitoring, note that various vendor technologies have been widely adopted and are encountered in almost all pentest engagements. I guess there is something to be said about a company's security maturity: as they engage in third-party pentests, it would be safe to say that these same companies invest in new monitoring tools for their industrial networks.

In this section, we will touch on the various vendors in the IDS security monitoring space, provide a high-level overview of what they typically detect, how they plug into the broader security suite of tools for events and alerting, and learn how to bypass these products and go undetected during a pentesting engagement. This is because it is quite...