Snort IDS / IPS Complete Practical Guide | TryHackme

[@inlak]

I'd got the same problem with the questions that you didn't found, and I really entered to this video trying to found the answers. Finally i found that the mode that works similar to NIPS is "NBA" (Network Behaviour Analysis), and the kind of NIPS that it is is "full-blown". Hope it will help!

[@MFmyk3]

thank you for explaining this. Been going through the SOC pathway and snort has completely stumped me by not fully explaining the contents of the output it gives (might as well be hieroglyphs lol) . Your teaching and break down of the concepts were super helpful in learning the fundamentals of it.

[@MFmyk3]

Is it possible to share your notes you keep referencing in the video?

[@MotasemHamdan]

Thank you for the remarks. The notes are part of the third tier of the channel membership@@MFmyk3

[@gabrieltorres6881]

Thanks!

[@MotasemHamdan]

Thank you Gabriel.

[@chicaomassari]

According to the official description of the snort, what kind of NIPS is it? full-blown

[@assassino689]

As usual, the greates professor! Thanks Motasem!

[@wabisabi84]

I'm sharing my experience here, hopefully, it helps others. I initially missed a key step in Task 8: Operation Mode4 - PCAP Investigations. There are multiple ways to get to point B but I choose the following path: Mr. Hamdan provided a helpful bash command to locate the relevant file: find . -name "icmp-test.pcap". After accessing the directory, I used the command while directory Task 8: snort -r icmp-test.pcap and had no problems moving to the next step. Thank you Mr. Hamdan

[@cloudhobbyist]

3rd to last question in task 4 is "full-blown". It is listed in the description of snort under the blue highlighted letters section.

[@deicyricks1700]

OMG!!!!! Thank you so much ! I feel less than dumb ! I spent a significant amount of time on that freaking question !!!!!!!

[@selena4072]

how did u get the traffic generator installed ?

[@MG-bm5oj]

Great job mate. I think this channel is underrated. I have a question. I watched on this video that you are using obsidian. Are you sharing with the comunity your notes or they are private?

[@MotasemHamdan]

Hello, you can subscribe to the channel membership tier 2 to get access to all the notes, link below kzbin.info/door/NSdU_1ehXtGclimTVckHmQjoin Or if you are interested in one subject among the others, you can pay for one time. The notes that are available for one time purchase can be found below motasem-notes.net/

[@johnvardy9559]

what a teacher.really i learn a lot of you.

[@rabahkhiari8621]

thanksssssss its a clear video and Very helpful and easy english that help me understand without having fluent english

[@ЮрійМинаш]

You are the best in explaining things Motasem , thanks a lot !

[@viorage2293]

I was messing with step 9, question 1, forever and thought I was failing. However, it was because I didn't realize the alert file being made :) Great vid.

[@hurrenbardinas490]

Great content. Please share your entire notes with me, focusing on the sudo command.

[@techskyrocket4101]

Can I ask what the notepad are you using? I want to put notes in somewhere and looking for suitable note pad.

[@FunnyAnimals-ko8zz]

The same question :) can you find an answer ?

[@techskyrocket4101]

@@FunnyAnimals-ko8zz it's obsidian ;)

[@FunnyAnimals-ko8zz]

@@techskyrocket4101 Thanks Bro :)

[@JohnFider]

This has been so helpful! Thank you!

[@isaacringling3823]

very helpful to follow along with at every spot I got stuck in the snort room. Thank you!

[@SandeepKumar-zb5uf]

Thank you so much @Motasem for creating this awesome video on Snort. It was really helpfull and informative from starting to end. I liked the way of your explaining the concepts or points in details with easy explanations. Again appreciated the hard work you put in this video :)

[@elisehackmann-tf6xg]

Very well organized and well explained! thank you ! that was really helpful

[@SaitejaG-h6h]

I was able to complete the task cuz of this video! Super clear :) Thanks much

[@samas69420]

what kind of packets are the ones you see in sniffer mode at 21:35?

[@johnvardy9559]

heeeyy mohamed great Containt.Please which tool has been used to keep documentation?

[@MotasemHamdan]

Heey, Its Obsidian.

[@johnvardy9559]

@@MotasemHamdan between Soc analyst or Cloud what do you think?

[@yousef_alshiekh1650]

hello motasem ty so much for your effort, i have 1 question ,where can I have or buy your notepad library?

[@MotasemHamdan]

Hello, you can subscribe to the channel membership tier 2 to get access to all the notes, link below kzbin.info/door/NSdU_1ehXtGclimTVckHmQjoin Or if you are interested in one subject among the others, you can pay for one time. The notes that are available for one time purchase can be found below motasem-notes.net/

[@yousef_alshiekh1650]

Tysm@@MotasemHamdan

[@SyedaNidaHassan]

Superb! Very well organised and well explained. Can you sahre your notes please.

[@MotasemHamdan]

Hello, you can subscribe to the channel membership tier 2 to get access to all the notes, link below kzbin.info/door/NSdU_1ehXtGclimTVckHmQjoin Or if you are interested in one subject among the others, you can pay for one time. The notes that are available for one time purchase can be found below motasem-notes.net/

[@tradesmenlife]

NBA and full-blown, thanks for this video, this snort was so complicated, they really need some gui platform

[@AlHoussem]

Nice Tutorial, many thanks

[@jamilshekinski]

1:20:15 - Network Behaviour Analysis - NBA. The second one is - full-blown.

[@DANIEL-p6b3x]

thank you for these video. they have been helpful. i am interested in your 974 page notes so it helps with easy referencing. does the package (priced at 34 dollars) contain the notes covering all your videos?thanks

[@MotasemHamdan]

Hello, did you mean the blue team notes?

[@ian230187]

Hi Motasem, For 9.4 , same ip question, when I used the protocol as ip, I got the answer as 13.. Just wanted to confirm the reason behind using tcp and udp and also just to update changes to rev field are not needed

[@anoopvijayan1565]

bro first you should remove the alert message that is generated as a result of the previous using the command "sudo rm -r alert". then open the local rule and add the tcp and udp rule as same as what Mr.Motasem Hamdan showed in this tutorial. Then you again run the rule. Then after you will get the answer 10.

[@Im-coming-in-2030]

Which snort mode works similar to NIPS mode? is a bhhaviour-based intrusion nba

[@roadragedrivers-pz6el]

Thank you, this section was very complicated

[@MG-bm5oj]

I have everything set up. Snort trigger an alert when I ping the pc where it is installed. The problem is when I do a ping to another PC within my network, Snort doesnt detect it. I have my network card in promisc mode. Any idea why is this happening?

[@dukenorris7]

What is the notebook you are using? I really like the way it tree's out. I am just using onenote.

[@mhmdmhidat2953]

Great video, the room is vet long and a bit boring, your videos add enthusiasm

[@deems4716]

Thank you for sharing this video, but i have question. i have pcaps file and i want command to i see traffic and some Alerts

[@anoopvijayan1565]

A clear video tutorial. Very helpful to tryhackme beginners. Thanks professor.😊😊

[@adnannazir7056]

which app do you use for storing notes

[@MotasemHamdan]

Obsidian

[@selena4072]

are your snort notes with the specific commands and explain what the commands do available online?

[@thepuldarshana9056]

Can you please install and configure on windows server?

[@Messi-n2u]

Sir task 3 answer 5 is NBA ❤ And thankyou so much sir 🙏🙏

[@MotasemHamdan]

Thank you too !

[@BrokenBrainOfficial]

could you please provide a link to your notes? that would be helpful

[@TorgnyHolmlund]

Which snort mode works similar to NIPS mode? NBA According to the official description of the snort, what kind of NIPS is it? full-blown

[@reels_shortt]

What is the name of the application in the taskbar marked with the letter s

[@GOODBOY-vt1cf]

19:45

[@CreepyGRC]

Thank you Motasem, that task 7 question though. haha

[@naijaguy1836]

Thanks again another awesome video

[@zero-ib1jd]

Great video thanks!

[@TheUnchartedTrail]

NBA training period is also known as ..? Test the current instance with "/etc/snort/snort.conf" file and check how many rules are loaded with the current build. ?

[@jessicajavaherian3992]

baselining

[@assassino689]

:))

[@VeNoM____]

Answer: 4151 > sudo snort -T -c /etc/snort/snort.conf

[@faithkolo]

Thank you so much for this. You are a life saver!

[@zarandiatada]

whats -dev means in sudo snort -dev -K ASCII -l .

[@MotasemHamdan]

Could you please specify at which minute:second in the video?

[@zarandiatada]

34:22 sudo snort -dev - K ASCII -l . @@MotasemHamdan your explanation is very nice man,god bless you,thank you.

[@hetpatel9369]

can you provide the access to your notes?

[@MotasemHamdan]

Once you are subscribed to channel membership, you wil able to access sys admin notes for Linux and Windows. You can also subscribe from here www.buymeacoffee.com/notescatalog/membership

[@chicaomassari]

Which snort mode works similar to NIPS mode? NBA

[@abdoal-saidi3735]

full-blown - baselining

[@memepasmal77]

Thank you Sir !

[@jamilshekinski]

Thank You habibi!!

[@mccrory]

Are you sharing your notes that you have saved?

[@mccrory]

i mean your notes library?

[@MotasemHamdan]

Hello, online access to notes is part of channel membership kzbin.info/door/NSdU_1ehXtGclimTVckHmQjoin

[@ruffajne]

what is rm?

[@MotasemHamdan]

Tool in Linux to remove files.

[@huuloc8719]

Thank you so much.

[@0mayhem]

Could anybody help me with the Task 4 Question 1 is the only question I'm missing, tried a lot of combinations with -V but no success

[@VeNoM____]

Answer: 149, type sudo snort -v

[@0mayhem]

@@VeNoM____ thanks bro!!

[@manuelchacon6298]

Good course , but the audio level is really low.

[@amjadalbalwy5180]

how can I block vpn packets mr?

[@abdelrahmanbadie410]

the answer of first one is NBA and the second is full-blown

[@naijaguy1836]

According to the official description of the snort, what kind of NIPS is it -> full-blown😉

[@aytenchelebili2213]

thanks for video

[@efeminihamilton7645]

Two missing answers are NBA and full-blown

[@alanchichilla]

Great video but dude turn off that alert noises that come up throughout the entire video. It scared me to death!

[@jaxson8262]

it is NBA

[@mutezgannam]

NPA , full-blown

[@martx0013]

❤

[@msarwar3934]

Hi Motasem, v lovely videos and explanations thank u. I would like to connect with you regarding some 1:1 coaching for blue team studies. Kindly let me know ur email/id etc or whatsapp plz Thank u 🙏🏾