X

Enroll your team

I agree to provide AO Kaspersky Lab, 39A/3 Leningradskoe Shosse Moscow, 125212 Russian Federation (“AO Kaspersky Lab”) with the following information about me (First Name, Last Name, email) order to allow AO Kaspersky Lab to contact me to participate in surveys and to send me information via email about Kaspersky Lab's products and services including personalized promotional offers and premium assets like white papers, webcasts, videos, events and other marketing materials. I confirm that I have been provided with this Privacy Policy for Web Sites. I understand that my consent is optional and I can withdraw this consent at any time via e-mail by clicking the “unsubscribe” link that I find at the bottom of any e-mail sent to me for the purposes mentioned above”. Web privacy policy https://www.kaspersky.com/web-privacy-policy

X

Register

I agree to provide AO Kaspersky Lab, 39A/3 Leningradskoe Shosse Moscow, 125212 Russian Federation (“AO Kaspersky Lab”) with the following information about me (First Name, Last Name, email) order to allow AO Kaspersky Lab to contact me to participate in surveys and to send me information via email about Kaspersky Lab's products and services including personalized promotional offers and premium assets like white papers, webcasts, videos, events and other marketing materials. I confirm that I have been provided with this Privacy Policy for Web Sites. I understand that my consent is optional and I can withdraw this consent at any time via e-mail by clicking the “unsubscribe” link that I find at the bottom of any e-mail sent to me for the purposes mentioned above”. Web privacy policy https://www.kaspersky.com/web-privacy-policy

X

Request Access

I agree to provide AO Kaspersky Lab, 39A/3 Leningradskoe Shosse Moscow, 125212 Russian Federation (“AO Kaspersky Lab”) with the following information about me (First Name, Last Name, email) order to allow AO Kaspersky Lab to contact me to participate in surveys and to send me information via email about Kaspersky Lab's products and services including personalized promotional offers and premium assets like white papers, webcasts, videos, events and other marketing materials. I confirm that I have been provided with this Privacy Policy for Web Sites. I understand that my consent is optional and I can withdraw this consent at any time via e-mail by clicking the “unsubscribe” link that I find at the bottom of any e-mail sent to me for the purposes mentioned above”. Web privacy policy https://www.kaspersky.com/web-privacy-policy

X

Pre-register

I agree to provide AO Kaspersky Lab, 39A/3 Leningradskoe Shosse Moscow, 125212 Russian Federation (“AO Kaspersky Lab”) with the following information about me (First Name, Last Name, email) order to allow AO Kaspersky Lab to contact me to participate in surveys and to send me information via email about Kaspersky Lab's products and services including personalized promotional offers and premium assets like white papers, webcasts, videos, events and other marketing materials. I confirm that I have been provided with this Privacy Policy for Web Sites. I understand that my consent is optional and I can withdraw this consent at any time via e-mail by clicking the “unsubscribe” link that I find at the bottom of any e-mail sent to me for the purposes mentioned above”. Web privacy policy https://www.kaspersky.com/web-privacy-policy

SAS Capture the flag competition register here

Suricata for Incident Response and Threat Hunting

Built for Tier 3 Threat Hunters

All levels

$890 inc. tax per learner

All levels

$890 inc. tax per learner

Enroll my team
Request demo access

Background

Suricata is the foundation for effective intrusion detection and prevention. With cyber attacks on the rise it’s more crucial than ever for businesses, enterprises or cybersecurity consultancies to have a comprehensive security strategy in place. And that’s where Suricata rules come to the rescue.

The “Suricata for Incident Response and Threat Hunting” course from Kaspersky xTraining is the ultimate training program taught by Kaspersky’s leading security researcher who has spent years on the front lines of cyber defense, Tatyana Shishkova. She will share unique insights and sophisticated tips and tricks, giving you an unparalleled understanding of the IDS/IPS within the Suricata rules framework.

The course is created for companies aiming to power up their security policy and individual learners, looking to advance their career in cyber security. Whether you’re a beginner specialist or a seasoned professional in security or SOC analysis, security administration, malware research or incident response, it will give you the knowledge and skills to stay ahead of the ever-evolving threat landscape.

Learn how to write and implement Suricata rules to detect and block even the most advanced threats. Gain a deep understanding of how the framework works, and how to use it for identifying and responding to attacks in real-time. Get practical experience to enhance your network security with hands-on exercises and various real-life scenarios.

Course leader

Tatyana Shishkova

Lead Security Researcher, GReAT

Tatyana Shishkova is a Lead Security Researcher with more than seven years’ experience in network traffic analysis. Working at Kaspersky for more than a decade, she specializes in reverse engineering and network intrusion detection using Suricata.

Tatyana is a regular speaker at major cybersecurity conferences, including PHDays, SuriCon, SAS, and Botconf.

Overview & objectives

  • Understand what is a NIDS and how to use it
  • Write Suricata rules for different protocols
  • Utilize tips and tricks to create fast and efficient rules
  • Learn about typical network attacks
  • Analyze suspicious traffic and recognizing traffic anomalies
  • Learn how to identify and fix a false alarm
  • Learn how to use Suricata for threat hunting
  • Gain new skills through a practical challenge in virtual environment

Syllabus

Who it's for

Cybersecurity consultancies

Train your consultancy team to create and fine-tune Suricata rules for maximum effectiveness so to provide more effective services to their clients.

Enterprises

Advance your SOC or cybersecurity team’s skills to implement effective network security policies moving towards detecting and preventing cyber attacks before they cause organisational damage.

InfoSec professionals

Advance your career as an incident responder, malware researcher, or security analyst. Get to know more about developing and deploying effective Suricata rules to prepare yourself for more advanced threats.

How you'll learn

Guided video lectures

Learn Suricata rules with guided video lectures, providing in-depth explanations of each topic and exercise.

Virtual lab

Practice your new skills in a safe virtual environment. Designed especially for our Suricata course, your virtual environment is loaded with all the tools you need to help you learn and succeed.

Iterative learning

The course is designed with an iterative learning approach with consistent modules based on specialist overviews of each task, practical work in a Virtual Lab and detailed expert solutions.

Be the first to find out...

Each and every month we share our latest news, tips, tricks and advice on all things cybersecurity related.
Be the first to find out when we run competitions, promotions, launch new courses, release free webinars and much more!

Sign up

Benefits

Access

6 months to complete your course from activation of your access code

Language

Courses delivered in English with subtitles

Pace

Self-guided learning that fits around your life

Course duration

It will take you approximately 18 hours to watch the videos

Downloads

PDF downloads of training materials and tips

Learning environment

Browser-based via desktop, mobile and tablet (excludes virtual lab which requires an RDP client)

Course author

Member of Kaspersky Global Research and Analysis Team (GReAT)

Guided videos

30+ videos to guide you through the course

Virtual lab

Safe virtual environment for hands-on learning

Certification of completion

PDF document on a Kaspersky letterhead certifying the completion of the course, signed by the course leader(s)