ccdcoe/cdmcs

Cyber Defence Monitoring Course Suite :: Suricata, Arkime (and others in the past)

Cyber Defence Monitoring Course Suite (CDMCS)

This material has been designed to be taught in a classroom environment.

The material is missing some of the contextual concepts and ideas that will be covered in class. Furthermore, we aim to cover bleeding edge open-source developments and emerging tools. Our materials link heavily to official sources and public materials, as those tools are under constant development. Latest information is therefore constantly evolving and duplicating these sources would be redundant.

Each course contains material for any intermediate-level dev-ops who has some experience with other security|monitoring tools and wants to learn IDS, PCAP or event processing technologies. We believe these classes are perfect for anyone who wants a jump start in learning these or who wants a more thorough understanding their internals.

Our goal is to make our students understand fundamental concepts that can be brought home and adjusted for your individual environments, as opposed to providing rigid guidelines that may not be applicable in most real-world scenarios. Details matter when building technical security and we believe the best teacher to be hands-on experience. Thus, our courses are purely practical and creative problem solving is encouraged.

Before You Register for Class

Please visit:

• https://suricata.io/
• https://arkime.com/

See:

• Prerequisites

Current Classes

• Suricata - Rule-based Threat Detection :: Not scheduled
  • Information and registration: https://ccdcoe.org/training/cyber-defence-monitoring-course-rule-based-threat-detection/
• Arkime - Large Scale Packet Capture Analysis :: 3 - 7 June 2024
  • Information and registration: https://ccdcoe.org/training/cyber-defence-monitoring-course-large-scale-packet-capture-analysis-june-2024/

Older Classes

• Prior iterations are preserved under respectively numbered annual branches. Please refer to them if you are interested in prior content.

Teachers

• markuskont
• mpihelgas
• regit
• hillar
• ...

cdmcs's Issues

links are dead

Hello guys,
I'm trying to prepare my laptop for the course, but it seems that links in that section (https://github.com/ccdcoe/CDMCS/blob/master/Moloch/prepare-laptop.md) are dead. I would be glad if I could download the installMolochSuricataEveboxKibana.sh script. Can you help me please? Thanks.

Use of EveBox development builds.

I noticed that you are using the development builds of EveBox with the timestamp as the version. This could be a pain as they "disappear" when a new one is built out of master due to the way the Debian repos work.

You might want to consider another option.. The Debian package here, http://evebox.org/files/development/, which is always the same as in that repo has a static filename.

Or, as of last weekend I finally tagged a release, http://evebox.org/files/release/, which are files that will never disappear. Its my intention to tag and release often, but I had some users ask for something more "stable" to run instead of builds out of git master.

Git

If trying to get us to use git instead of following the instructions on the prepare laptop page, should probably include some basics on how to do that (as not everyone speaks fluent git)

Suppressing LaTeX formatting in pandas DataFrame

You can turn off MathJax option for pandas to prevent LaTeX formatting in DataFrames

pd.options.display.html.use_mathjax = False