Suricata: OpenSOC CTF Tool Demo
Explains how to write, tune, and inspect Suricata intrusion detection signatures to identify exploit traffic in OpenSOC.
Summary
High-Performance Intrusion Detection
Suricata is a mature, open-source network threat detection engine capable of real-time intrusion detection (IDS), intrusion prevention (IPS), and network security monitoring.
Investigating Alerts in OpenSOC
The demonstration shows how Suricata signatures generate structured EVE JSON output, allowing analysts to triage signature matches and correlate alerts with raw network sessions.
Rule Tuning and Protocol Inspection
Participants learn techniques for refining signature rules, inspecting multi-gigabit traffic streams, and detecting exploit payloads traversing internal and perimeter network interfaces.
Related talks
Blue Team Village·33 min
Zeek Team
Shows how to analyze network traffic, extract protocol metadata, and identify malicious connections using Zeek in OpenSOC.
Blue Team Village·31 min
Charles Rumford
Charles Rumford challenges overly complex network security designs, showing how simplifying routing and segmentation enhances defensive posture.
Blue Team Village·24 min
Drimacus
Drimacus presents research on operating passive Next-Generation Firewalls (NGFWs) alongside existing detection stacks to enhance network threat hunting and visibility.