No EDR, No logs, No problems... How Suricata can save detection in OT world?
Legacy Operating Systems, Real Time Operating Systems, black box devices using special protocols, no EDR available, system logs that are difficult to collect... Monitoring the security of OT devices can prove challenging for most security tools on the market. Find out how Suricata helped me to detect malicious activity, particularly on medical devices.
Consignes aux participants
- Carte réseau RJ45
- Câble réseau 10M
- Machine physique ou VM, archi amd64, minimum: 9Go de Ram, CPU 2 cores et 20Go d'espace disque minimum
- Télécharger et installer ClearNDR Community (ISO / docker au choix) ou une autre solution comme Security Onion, ou Suricata
- Prévoir un éditeur pour l'écriture de règles (type VS Code, ou selon vos habitudes)
Charles BLANC-ROLIN
Swiss knife in cybersecurity, Suricata enthusiast, I finally joined a CERT Team as Lead SOC analyst a year ago, after 17 years in french healthcare sector.
I’m sharing my discoveries through detection rules with PawPatrules ruleset.