-
The Securing Cisco Networks with Open Source Snort (SSFSNORT) course shows you how to set up a network intrusion detection system based on Snort. Through a combination of expert instruction and hands-on practice, you will learn how to install, configure, operate and manage a Snort system. You will also explore writing rules with an overview of basic options, writing advanced rules, configuring PulledPork, and using OpenAppID to protect your network from malware. You'll learn techniques for tuning and performance monitoring, traffic flow through Snort rules, and more.
-
Course Contents
-
- Describe Snort technology and identify the resources available for maintaining a Snort deployment
- Install and configure a Snort deployment
- Configure the command-line options for starting a Snort as a sniffer, a logger, and an intrusion detector, and create a script to start Snort automatically
- Identify and configure available Snort intrusion detection outputs
- Describe rule sources, updates, and utilities for managing rules and updates
- Detail the components of the snort.lua file and determine how to configure it for your deployment
- Configure Snort for inline operation using the inline-only features
- Configure rules for Snort using basic rule syntax
- Describe how traffic flows through Snort and how to optimize rules for better performance
- Configure advanced-rule options for Snort rules
- Configure OpenAppID features and functionality
- Tune Snort for efficient operation and profile system performance
You will receive the original course documentation from Cisco in English language as a Cisco E-Book. In the Cisco Digital Learning Version, the content of the courseware is integrated into the learning interface instead.
-
Target Group
-
- Security Administrators
- Security Consultants
- Network Administrators
- System Engineers
- Technical Support Personnel
- Channel Partners and Resellers
-
Knowledge Prerequisites
-
There are no prerequisites for this training course. However, it is recommended that you have the following knowledge and skills before attending this training course:</p
- Technical understanding of the Transmission Control Protocol/Internet Protocol (TCP/IP) and network architecture
- Know how to use Linux and UNIX word processing programs, e.g. vi editor
You can find this knowledge in the following Cisco course:
-
Course Objective
-
This training will help you:
- Learn how to implement Snort, an open-source, rules-based intrusion detection and prevention system
- Acquire leading skills for demanding tasks in the field of security
| Course Outline |
| Module 1: Introduction to Snort Technology |
| Module 2: Snort Installation |
| Module 3: Snort Operation |
| Module 4: Snort Intrusion Detection Output |
| Module 5: Rule Management |
| Module 6: Snort Configuration |
| Module 7: Inline Operation and Configuration |
| Module 8: Snort Rule Syntax and Usage |
| Module 9: Traffic Flow Through Snor t Rules |
| Module 10: Advanced Rule Options |
| Module 11: OpenAppID Detection |
| Module 12: Tuning Snort |
| Labs Outline |
| This course contains 12 hands-on virtual lab exercises, powered by Cisco Learning Labs and Cisco IOL (Cisco IOS on Linux). |
-
Classroom training
- Do you prefer the classic training method? A course in one of our Training Centers, with a competent trainer and the direct exchange between all course participants? Then you should book one of our classroom training dates!
-
Online training
- You wish to attend a course in online mode? We offer you online course dates for this course topic. To attend these seminars, you need to have a PC with Internet access (minimum data rate 1Mbps), a headset when working via VoIP and optionally a camera. For further information and technical recommendations, please refer to.
-
Cisco Digital Learning
- This course is available in the Cisco Digital Learning Library. These recently developed, multi-modal training events include HD videos moderated by lecturers with stored searchable text and subtitles, as well as a exercises, labs, and explanatory text and graphics. We provide this offer to you via our myExperTeach learning portal. Effective of the activation of the account, access to the courses will be granted for a duration of 6 months. In the case of packet solutions (Cisco Digital Learning Subscriptions), this time period will amount to 12 months.
-
Tailor-made courses
-
You need a special course for your team? In addition to our standard offer, we will also support you in creating your customized courses, which precisely meet your individual demands. We will be glad to consult you and create an individual offer for you.
You can find the complete description of this course with dates and prices ready for download at as PDF.-
The Securing Cisco Networks with Open Source Snort (SSFSNORT) course shows you how to set up a network intrusion detection system based on Snort. Through a combination of expert instruction and hands-on practice, you will learn how to install, configure, operate and manage a Snort system. You will also explore writing rules with an overview of basic options, writing advanced rules, configuring PulledPork, and using OpenAppID to protect your network from malware. You'll learn techniques for tuning and performance monitoring, traffic flow through Snort rules, and more.
-
Course Contents
-
- Describe Snort technology and identify the resources available for maintaining a Snort deployment
- Install and configure a Snort deployment
- Configure the command-line options for starting a Snort as a sniffer, a logger, and an intrusion detector, and create a script to start Snort automatically
- Identify and configure available Snort intrusion detection outputs
- Describe rule sources, updates, and utilities for managing rules and updates
- Detail the components of the snort.lua file and determine how to configure it for your deployment
- Configure Snort for inline operation using the inline-only features
- Configure rules for Snort using basic rule syntax
- Describe how traffic flows through Snort and how to optimize rules for better performance
- Configure advanced-rule options for Snort rules
- Configure OpenAppID features and functionality
- Tune Snort for efficient operation and profile system performance
You will receive the original course documentation from Cisco in English language as a Cisco E-Book. In the Cisco Digital Learning Version, the content of the courseware is integrated into the learning interface instead.
-
Target Group
-
- Security Administrators
- Security Consultants
- Network Administrators
- System Engineers
- Technical Support Personnel
- Channel Partners and Resellers
-
Knowledge Prerequisites
-
There are no prerequisites for this training course. However, it is recommended that you have the following knowledge and skills before attending this training course:</p
- Technical understanding of the Transmission Control Protocol/Internet Protocol (TCP/IP) and network architecture
- Know how to use Linux and UNIX word processing programs, e.g. vi editor
You can find this knowledge in the following Cisco course:
-
Course Objective
-
This training will help you:
- Learn how to implement Snort, an open-source, rules-based intrusion detection and prevention system
- Acquire leading skills for demanding tasks in the field of security
| Course Outline |
| Module 1: Introduction to Snort Technology |
| Module 2: Snort Installation |
| Module 3: Snort Operation |
| Module 4: Snort Intrusion Detection Output |
| Module 5: Rule Management |
| Module 6: Snort Configuration |
| Module 7: Inline Operation and Configuration |
| Module 8: Snort Rule Syntax and Usage |
| Module 9: Traffic Flow Through Snor t Rules |
| Module 10: Advanced Rule Options |
| Module 11: OpenAppID Detection |
| Module 12: Tuning Snort |
| Labs Outline |
| This course contains 12 hands-on virtual lab exercises, powered by Cisco Learning Labs and Cisco IOL (Cisco IOS on Linux). |
-
Classroom training
- Do you prefer the classic training method? A course in one of our Training Centers, with a competent trainer and the direct exchange between all course participants? Then you should book one of our classroom training dates!
-
Online training
- You wish to attend a course in online mode? We offer you online course dates for this course topic. To attend these seminars, you need to have a PC with Internet access (minimum data rate 1Mbps), a headset when working via VoIP and optionally a camera. For further information and technical recommendations, please refer to.
-
Cisco Digital Learning
- This course is available in the Cisco Digital Learning Library. These recently developed, multi-modal training events include HD videos moderated by lecturers with stored searchable text and subtitles, as well as a exercises, labs, and explanatory text and graphics. We provide this offer to you via our myExperTeach learning portal. Effective of the activation of the account, access to the courses will be granted for a duration of 6 months. In the case of packet solutions (Cisco Digital Learning Subscriptions), this time period will amount to 12 months.
-
Tailor-made courses
-
You need a special course for your team? In addition to our standard offer, we will also support you in creating your customized courses, which precisely meet your individual demands. We will be glad to consult you and create an individual offer for you.
You can find the complete description of this course with dates and prices ready for download at as PDF.
Online Training
Trainer language English