If this is the first time forensic analysis has been run, you must import some rules.

5Click the Import Snort Files button to display a file selection dialog. Browse to the directory where the rules you wish to import are located and select them. You can select multiple files using either CTRL-clicks or by simply dragging the cursor across the files you wish to select. If you do not yet have the Snort rules, see “Rules tab” on page 106.

6Click OK when you are done selecting files.

Observer displays a progress bar and then an import summary showing the results of the import. Because Observer’s forensic analysis omits support for rule types and options not relevant to a post-capture system, the import summary will probably list a few unrecognized options and rule types. This is normal, and unless you are debugging rules that you wrote yourself, can be ignored.

7Close the Import Summary Window.

8Click the Edit button to the right of the Rules profile dropdown menu.

Figure 68 Forensic Settings

The Rule Settings dialog is displayed (Figure 69). The top portion of the window lists the rules that were imported, grouped in a tree with branches that correspond to the files that were imported.

96

Starting Forensic Analysis using Snort rules

 

Chapter 6 Forensic Analysis using Snort

rev. 1

Page 95 Page 97
Page 96
Image 96
Network Instruments 114ff manual Forensic Settings
Page 95 Page 97

114ff specifications

Network Instruments 114ff is a sophisticated platform designed to enhance network visibility and performance management. This state-of-the-art device is aimed at network professionals who require a deep insight into their network’s behavior and performance metrics. One of its main features is its ability to provide real-time monitoring and analytics, which is crucial for quick decision-making in IT environments.

With a robust set of technologies embedded in its architecture, Network Instruments 114ff leverages advanced packet capture and analysis capabilities. It employs deep packet inspection (DPI) technology to evaluate data packets as they traverse the network. This functionality allows administrators to dissect various layers of network traffic, enabling them to identify anomalies and troubleshoot issues effectively. The 114ff can analyze both encrypted and unencrypted traffic, an asset as organizations increasingly adopt encryption protocols.

Another prominent feature of the Network Instruments 114ff is its customizable dashboard, which can be tailored to present the most relevant metrics at a glance. Users can visualize their network performance through a variety of graphs, charts, and alerts signaling potential performance degradation. This feature aids network managers in assessing key performance indicators (KPIs) and helps ensure that service level agreements (SLAs) are met.

The device is equipped with extensive reporting capabilities, allowing users to generate historical reports for analysis and compliance purposes. This function is essential for businesses that must comply with regulatory standards, as it enables them to maintain records of network performance and security incidents.

Furthermore, Network Instruments 114ff supports a variety of network protocols, ensuring compatibility with existing infrastructure. Its scalable architecture means organizations can adapt the device to cater to growing network demands without the need for significant overhauls. The integration capability with other Network Monitoring Systems (NMS) positions it as a flexible solution suited for diverse environments.

In summary, Network Instruments 114ff stands out as an essential tool for IT professionals looking to optimize network performance. With features such as real-time monitoring, deep packet inspection, customizable dashboards, and robust reporting capabilities, it delivers a comprehensive solution to manage and enhance network infrastructures effectively.
Top Page Image Contents