Free SOC? — how open source tools can come to our aid
summary
A practical rundown of open-source components for building a SOC: GVM/OpenVAS for authenticated vulnerability scanning and host topology (resource‑heavy and with slow community feeds), Suricata and Snort for high‑performance IDS/IPS, Arkime for full‑traffic capture and forensic indexing, MISP for automated threat‑intelligence sharing, Wazuh and Security Onion for log collection and correlation, and Sigma rules as a portable detection language to convert alerts between systems. The talk covers deployments and integrations of these tools and notes demos can fail but each tool is deployable in practice.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 3:38What is SOC and Open Source benefits
- 8:46Asset management tools
- 12:31Threat monitoring platforms
- 17:43Demo: Greenbone and GVM
- 22:15OpenVAS in practice
- 27:34Security Onion and others
- 30:29Sigma format and SIEM future
- 32:37Summary and Q&A
related talks
04h 02mOpen-source Tools for CSIRTs
46m5 Open Source Security Tools All Developers Should Know About
35mOpen source security: Opportunity or oxymoron?
44mSecurity Research with Open Source Software: Vol. Omega
30mModern SOC:Less Than One and More Than Infinity
34mOSINT for Proactive Defense
01h 45mPeel Back the Layers of Your Enterprise with the NEW Security Onion 2.0!
29mAttack Defense Graph Analysis for Supporting SOC and CSIRT Operations