Stamus Networks Blog

We believe that sharing information is necessary to improve global security. The purpose of this blog is to share our experiences, perspectives and experiments.

Subscribe to our Blog

Blog /
Showing 98 results
of 98 items.
Reset All

Category

Suricata Threat Hunting Fundamentals

Before beginning any sort of threat hunt, it is important to consider the tools you are using. This...

Threat Hunting with Suricata and Newly-Registered Domain Threat Intel (Open NRD)

In aprevious blog post, we announced the release of Open NRD from Stamus Networks - a set of threat...

Introducing Open NRD: Newly Registered Domain Threat Intel Feeds for Suricata

This article describes the details of the new Open NRD threat intelligence feeds provided by Stamus...

Malware PCAP Analysis Made Easy Part 4

In aprevious blog post, we compiled a number of useful JQ command routines for fast malware PCAP...

Malware PCAP Analysis Made Easy Part 2

In aprevious blog post, we compiled a number of useful JQ command routines for fast malware PCAP...

Malware PCAP Analysis Made Easy

When a threat researcher is investigating malware behavior and traces on the network, they need a...

A Practical Guide to Small Office / Home Office Network Visibility with SELKS: Part 1 - Equipment Selection

Have you ever counted how many computer devices, smart IoT gadgets, TV’s, kitchen appliances,...

Just Released: Suricata 7

Yesterday (18-July-2023) the OISF announced the general availability of Suricata version 7. It’s...

Closing a Suricata Supply Chain Attack Vulnerability

On 15-June-2023 the OISF announced a new release of Suricata (6.0.13) which fixes a potential...

Unlocking the Secrets of Forensic Investigations: Solving the SANS Forensic Quiz using SELKS

Are you looking to improve your threat hunting and network based forensic analysis skills with...

Accelerate Suricata Rule Writing with Suricata Language Server v0.9.0

Writing Suricata rules has never been easier or faster since the release of the Suricata Language...

Jupyter Playbooks for Suricata | Part 3

This is the third post in a series based on my Suricon 2022 talk Jupyter Playbooks for Suricata....

Analyzing Network Traffic with Kibana in SELKS: the SN-Hunt-1 Dashboard Part 1

Keeping your network secure can feel like an endless game of cat and mouse. But with SELKS and its...

The Hidden Value of Suricata Detection Events: NSM-Enriched IDS Alerts

If you use Suricata, then you are familiar with the way Suricata generates detection events —...

Use SELKS to solve the Unit 42 Wireshark Quiz

This blog describes how to solve the Unit 42 Wireshark quiz for January 2023 with SELKS instead of...

Jupyter Playbooks for Suricata | Part 2

This is the second post in a series that will be based on my Suricon 2022 talk Jupyter Playbooks...

Jupyter Playbooks for Suricata | Part 1

This is the first post in a series that will be based on my Suricon 2022 talk Jupyter Playbooks...

Inside SELKS: What's Under the Hood

SELKS is a turnkey Suricata-based IDS/IPS/NSM ecosystem that combines several free, open-source...

Analysis of TLS Cipher Suite Security in Stamus App for Splunk

The latest version (1.0.1) of  the Stamus App for Splunk adds TLS cipher suite analysis. Conducting...

Reflections on Suricon 2022

Last week our team was in Athens for the biggest Suricata conference this year - Suricon 2022. The...

Why We Wrote the Book on Suricata

As we celebrate the first week after launching our new book “The Security Analyst’s Guide to...

NEW! Open Ruleset for Detecting Lateral Movement in Windows Environments with Suricata

Today, we’re announcing a new open-source contribution from Stamus Networks - a Suricata ruleset...

Stamus Networks at Suricon 2022

Each year, Suricon attracts visitors from all over the world for three days of knowledge sharing...

Embrace Open Interfaces and Open Source

When the leadership team at Stamus Networks got together to capture the core principles of our...

SELKS 7: Deployment and Applications

Perhaps the most exciting thing about the release of SELKS 7 is the various practical applications...

SELKS 7: Newly Updated Capabilities

This series introduces SELKS 7, the latest update to the free, open-source, turn-key Suricata based...

SELKS 7: An Introduction

In this series, you will get an overview of the SELKS 7 platform, the new updates and functionality...

Introducing Suricata Language Server: Real-time Rule Syntax Checking and Auto-completion

Writing signatures for Suricata and other intrusion detection systems (IDS) is considered by many...

Suricata to the Log4j Rescue

Following the 10-December-2021 announcement of (CVE-2021-44228), Log4shell scanners have begun to...

Intrusion Analysis and Threat Hunting with Open Source Tools @ FloCon 2022

In its early years, FloCon was an academic conference focused exclusively on network flow data but...

SuriCon 2021: Through the Eyes of the Conference Organizers

This year SuriCon was a hybrid event for the first time ever. The conference was held both...

SuriCon 2021: Through the Eyes of the Stamus Networks Team

Regular readers of this blog and friends of Stamus Networks will know that we are very closely...

Spin up a Complete Suricata Network Security Platform in Under 2 Minutes

Believe it or not, you can launch a turnkey Suricata IDS/IPS/NSM installation – with as few as 4...

The Art of Suricata QA GitLab Automation @ Suricon

I’m pleased to partner with the OISF QA Engineer and Automator - Corey Thomas for this year’s...

Unleash Suricata Superpowers with a Splunk App @ Suricon

At next week's Suricon 2021, I'll be sharing real world examples of how a new Splunk App can help...

Efficient Suricata: Migrating from Millions of Events to Manageable Insights @ Suricon

I’m pleased to partner with my colleague and OISF Board Member - Eric Leblond for this year’s...

The Other Side of Suricata

You may be surprised to learn that Suricata produces not only IDS alerts but also produces logs of...

Coming Soon in Suricata 7: Conditional PCAP @ Suricon

SuriCon is the annual open source technology community conference that highlights discussions and...

Advanced Deployment & Configuration with Suricata @ Suricon

I’m pleased to partner with my colleague and OISF Board Member - Eric Leblond. Together, we want to...

SELKS on Docker: A Much More Portable and Agnostic Solution

Here at Stamus Networks, we are strongly committed to open-source and believe that ease of use has...

Detection Technology Truth-telling and a Focus on Results

In my last blog article, I introduced some of the factors that have contributed to our successes...

Much more than just another NDR Vendor

In cybersecurity as soon as you stand still, you’re falling behind. Change, whether it’s in the...

Suricata: The First 12 Years of Innovation

Suricata, the open source intrusion detection (IDS), intrusion prevention (IPS), and network...

Scaling Suricata in the Enterprise - Leverage Advanced Analytics

Background

As we have previously written, for all Suricata’s capabilities, building out an...

Scaling Suricata in the Enterprise - Consolidate Alerts and Logs

Background

As we have previously written, for all Suricata’s capabilities, building out an...

Scaling Suricata in the Enterprise - Tuning the Sensors

Background

As we have previously written, for all Suricata’s capabilities, building out an...

Scaling Suricata in the Enterprise - Centralizing Sensor Management

For all Suricata’s capabilities, building out an enterprise-scale deployment of Suricata with...

Scaling Suricata in the Enterprise - Optimize Sensor Placement

As we’ve written before, Suricata is a high-performance network threat detection, IDS, IPS and...

Introducing the Stamus Networks App for Splunk®

This week we announced the new Stamus Networks App for Splunk®. You can read our press release here...

Just Released: Suricata 6

Exciting news - the OISF just announced that Suricata 6 is now available. This is the culmination...

From Open Source IDS to Cyber Kill Chain to SOAR – My First Eight Weeks at Stamus Networks

Stamus Networks? They are the Suricata company aren’t they? And Suricata? It’s an open source IDS...

SELKS 6 [The stuck-at-home edition]

SELKS 6 is out!

If you are still teleworking, you may wish to test and deploy this new edition to...

Whitepaper: Introduction to eBPF and XDP support in Suricata

eBPF and XDP support is one of the latest evolutions of the Suricata engine’s performance...

SELKS 5 - The Sorceress

SELKS 5 is out! Thank you to the whole community for your help and feedback! Thank you to all the...

SELKS5 RC1 - Threat Hunting and more...

Hi!Yet another upgrade of our SELKS. We are very thankful to all the great Open Source projects and...

SELKS5 Beta: new hunting interface and FPC

Hey! Our new and upgraded showcase for Suricata has just been released - SELKS5 Beta. Thanks to...

Scirius 2.0 is here to get your Suricata easier, faster, stronger

Stamus Networks is proud to announce the availability of Scirius Community Edition 2.0. This is the...

SELKS 4.0

This first edition of SELKS 4 is available from Stamus Networks thanks to a great and helpful...

Suricata 4.0 and why it does matter

Suricata 4.0 is out and this switch from 3.x to 4.x is not marketing driven because the changes are...

SELKS 4 RC1

After a very valuable round of testing and feedback from the community we are pleased to announce...

Scirius CE 1.2.0 is for IPS and collaboration

Stamus Networks is proud to announce the availability of Scirius 1.2.0. This release of our...

Slides and video of "Suricata and eBPF" talk

Eric Leblond gave a talk entitled "The adventures of a Suricata in eBPF land" at netdev 1.2, the...

Suricata bypass feature

Introduction

Stamus Networks was working on a new Suricata feature named bypass. It has just been...

The third SELKS is out

Yes, we did it: the most awaited SELKS 3.0 is out. This is the first stable release of this new...

Amsterdam 1.0, SELKS and docker

Stamus Networks is proud to announce the availability of version 1.0, nicknamed "glace à la...

Let’s talk about SELKS 3.0RC1

After some hard team work, Stamus Networks is proud to announce the availability of SELKS 3.0RC1.

Scirius 1.1.6 brings new key features

Stamus Networks is proud to announce the availability of Scirius 1.1.6. This new release brings...

Get info on suricata using JSON stats data

Suricata stats in EVE JSON format

Suricata 3.0 will come with a lot of improvements on the output...

Amsterdam: SELKS & Docker using Compose

Stamus Networks is proud to announce the availability of the first technology preview of Amsterdam.

Version 1.1 brings Scirius to a new level

Stamus Networks team is proud to announce the availability of Scirius 1.1. This new release brings...

Finding self signed TLS certificates - Suricata and Luajit scripting

Introduction

This is a short tutorial of how you can find and store to disk a self signed TLS...

Looking at suricata JSON events on command line

Suricata EVE JSON format is becoming the de-facto standard for this IDS. All type of events are now...

Let's talk about SELKS 2.0

Stamus Networks is proud to announce the availability of SELKS 2.0  release.

Scirius 1.0 is out

Stamus Networks is proud to announce the availability of Scirius 1.0. This is the first stable...

SELKS 2.0 beta1 based on Debian Jessie

Stamus Networks is proud to announce the availability of SELKS 2.0 BETA1 release. With Jessie...

Run you own Suricata QA

Some words about PRscript

PRSCript is a script that run a series of builds and tests on a given...

Let’s talk about SELKS 1.2

Stamus Networks is proud to announce the availability of SELKS 1.2 stable release. SELKS is both...

Conky for SELKS

Conky is a cool, desktop and lightweight monitoring tool. SELKS comes with a ready to use Conky...

Accuracy of Elasticsearch facets

Introduction

Elasticsearch and Kibana are wonderful tools but as all tools you need to know their...

Let’s talk about SELKS 1.1

Stamus Networks is proud to announce the availability of SELKS 1.1 stable release. SELKS is both...

Using Stamus Networks Debian Repositories

Stamus Networks supports its own generic and standard Debian Wheezy 64 bit packaging repositories...

Slides of SELKS lightning talk at hack.lu

After giving a talk about malware detection and suricata, Eric Leblond gave a lightning talk to...

SELKS privacy dashboard

Introduction

SELKS 1.0 is featuring a privacy dashboard. This is a dashboard focusing on HTTP and...

Let's talk about SELKS 1.0

Stamus Networks is proud to announce the availability of SELKS 1.0 stable release. SELKS is both...

SELKS 1.0 RC1 is out

Stamus Networks is proud to announce the availability of SELKS 1.0 RC1. This is the first release...

A Suricata application for Splunk

Thanks to the EVE JSON events and alerts format that appear in Suricata 2.0, it is now easy to...

SELKS 1.0 beta2 is available

Stamus Networks is proud to announce the release of SELKS 1.0 beta2. This is the second public...