Defensive / Blue

Suricata

Network IDS/IPS and network security monitoring engine.

advanced

Linux

Defense

Authorized testing only. Practice on systems you own, isolated labs, or targets with written permission. Unauthorized access is illegal.

Detecting attack traffic in lab or production networks.

Configure capture interface; load rules; review eve.json alerts.

Understand what your scans look like to defenders.

Commands & usage

sudo suricata -c /etc/suricata/suricata.yaml -i eth0

tail -f /var/log/suricata/fast.log

Commands are educational examples. Adapt hosts, paths, and rates to your authorized scope.

Sigma Rules

Generic detection rule format convertible to SIEM queries.

osquery

SQL-powered endpoint visibility agent.

Wazuh

Open-source XDR/SIEM platform for log analysis and FIM.

Fail2ban

Bans IPs that show malicious signs (e.g., too many SSH failures).