ICYMI,
Last friday I posted a significant update to Suricata: An Operator's guide, my book that dives into how network security teams can get the most of Suricata: a powerful open-source network intrusion detection/prevention suite.
While its primarily a book concerned with the intricacies of Suricata, how to deployment, how to write rules for it, and how to measure and improve its performance, a large portion of this work has been dedicated towards how to do a variety of threat research tasks, such as vulnerability research, and proof of concept reproduction, threat hunting, data pivoting, etc. in order gain enough indicators to assist in writing new Suricata rules.
This latest chapter I've completed details how Suricata can be used to inspect and analyze TLS-encrypted traffic, and goes over non-invasive methods of analyzing TLS through the use of Suricata's TLS keywords that can be used to inspect various aspects of TLS connections (e.g. server name indicators, certificate details, etc.). We also talk about the various options for decrypting TLS traffic to inspect the decrypted traffic within such as TLS Master Secrets logging, Host-based intercept proxies (e.g., mitmproxy, burp, zap, etc.), as well as live network-based decryption suites (e.g., SSLProxy, PolarProxy, etc.). We also discuss some of the weaknesses and difficulties that come with analyzing TLS encrypted traffic to be aware of.
I welcome you to download a copy over at leanpub.com/suri_operator. My books are always DRM-free PDFs, and the price will always be "pay what you want", with the minimum price set to free, because I want to educate our next generation of security professionals, for when I run off into the forests of norther Michigan to never be seen again.
As always, thank you to my followers, supporters and patrons for providing me with feedback along the way.