Open-source Tools for CSIRTs
Talkat FIRST & AfricaCERT Virtual Symposium for the African and Arab Regions 2021 · 2021-12-07..12-09·
summary
Practical CSIRT stack built from TunCERT field experience: a perimeter demo using pfSense on FreeBSD with DMZ/LAN rules and CARP high‑availability, network detection with Suricata IDS/IPS (signatures and high‑performance multicore capture), log/IOC correlation via Security Onion + MISP, automated advisories and constituency mailing with Taranis, incident tickets in GLPI, and forensics using Autopsy/Volatility, cuckoo sandbox and OpenCTI. Virtual lab images and credentials are offered for hands‑on replication; expected tradeoffs: license cost savings but need operations and signature updates.
AI-written summary · about
chapters (38)
- 0:00Introduction to infrastructure
- 1:10Program overview
- 2:22Open source strategy
- 3:41Security budget management
- 5:58Benefits of open source
- 8:53Security risks and solutions
- 10:26Software cost and support
- 13:48Building secure architecture
- 17:23Network perimeter protection
- 21:22High availability firewalls
- 24:40Pfsense demonstration
- 30:28Configuring Pfsense rules
- 34:15DMZ and interface setup
- 37:10Advanced firewall rules
- 43:54Intrusion detection systems
- 51:05Suricata and NIPS
- 57:11Suricata installation demo
- 1:03:06Advanced threat detection
- 1:11:50Forensics and monitoring
- 1:19:28Web access control
- 1:25:11Encryption and secure storage
- 1:33:20Web application firewalls
- 1:42:08Cybersecurity monitoring systems
- 1:46:40Security platform demonstration
- 1:54:27Cybersecurity honey nets
- 2:04:16Malware analysis and forensics
- 2:09:04Incident handling processes
- 2:15:12Taranis threat intelligence
- 2:19:23Incident response guidance
- 2:23:21Reporting security events
- 2:30:35Analytics and reporting
- 2:33:55Knowledge base management
- 2:51:40Advisory and patching
- 2:59:26Investigation techniques
- 3:04:59Incident response cycle
- 3:10:40Forensic data collection
- 3:20:56Advanced forensic tools
- 3:31:30Advanced investigation lab
related talks
33mFree SOC? — how open source tools can come to our aid
17mExpansion of ICS Testbed for Security Validation based on MITRE ATT&CK Techniques
34mLightning Talks
29mAttack Defense Graph Analysis for Supporting SOC and CSIRT Operations
31mApproaches & Practices for Increasing the Maturity & Capabilities for CSIRTs in Emerging Economies
58mConducting Defensive Information Warfare on Open Platforms
29mPractical ISP CSIRT Incident Handling w/ Network Flows, ELK Stack & Cybersecurity Intelligence...
29mDetection Engineering: Defending Networks with Purpose