2013 Doug Burks - Security Onion: Peeling Back the Layers of Your Network in Minutes

Overview: alerts alone are not enough we need to take an ids alert and we need to surround it with all this contextual data what we really need is something called network security monitoring which is a methodology methodology that originated in the air force and and it said we need to take all of these data types we need to take ids alerts and full page capture and session data and transaction logs and give all of those to the analyst and allow the analyst to pivot between those data types mercilessly ju

Key Topics: st like the attackers are pivoting through our networks mercilessly we as defenders need to take all this data and pivot from one data type to another to be able to fully defend our network