Главная
Study mode:
on
1
Introduction
2
Two methods of detection
3
Adding metadata to SSL logs
4
Python script
5
Live demo
6
Exiting the viewer
7
Dashboard
8
Visualizations
9
J3 Description
10
J3 Unknown
11
PowerShell Bits
12
Metasploit
13
Source destination
14
Clientside hash
15
Traditional SSL log
16
System on Data
17
Bro Notice
18
Country Codes
19
UID
20
Intel
21
Source
22
Network analyst
23
Questions
Description:
Explore innovative techniques for detecting traffic anomalies using SSL certificates in this 37-minute conference talk from the Security Onion Conference 2019. Delve into two distinct detection methods and learn how to enhance SSL logs with additional metadata. Follow along with a live demonstration of a Python script designed for this purpose. Discover the power of dashboards and visualizations in identifying anomalies, and gain insights into various tools and concepts such as J3 Description, PowerShell Bits, Metasploit, and traditional SSL logging. Understand the importance of country codes, UID, and intel sources in network analysis. Equip yourself with valuable knowledge to improve your security monitoring capabilities and detect potential threats more effectively.

Finding Traffic Anomalies Using SSL Certificates

Security Onion
Add to list
0:00 / 0:00