Jupyter Playbooks for Suricata

Presented at SuriCon 2022 by Markus Kont
Suricata produces a lot of data. EVE has over 1000 distinct JSON fields over large amount of supported event types. Likewise, rulesets contain tens of thousands of rules. This makes it difficult to truly understand the data, and users often need to resort to large SIEM and data analytics engines for doing that.
Jupyter notebook is a interactive data exploration tool that originated from scientific communities. In the recent years, they have become increasingly more popular for threat hunting and incident response. This talk demonstrates how Stamus Networks uses Jupyter notebooks for Suricata rule exploration, R&D prototyping for threat hunting and analytics, and in our upcoming open suricata-analytics threat hunting playbooks.

[@t_green]

Markus is always working on something interesting, thanks for sharing!