So, where am I going from here in the Suricata Book?

As much as I said I'm done with the TLS inspection stuff for chapter 10, there is one last thing I want to include before moving on.

A large portion of the TLS inspection chapter was how to architect an environment to use SSLProxy or PolarProxy.

I include like 3-4 pages of troubleshooting recommendations for SSLproxy, but I didn't really put anything together for troubleshooting problems with PolarProxy. I went over how to configure PolarProxy for two modes of operation: TLS Forward Proxy (like SSLProxy) and having it operate as an HTTP CONNECT proxy. I'd like to make sure that I point readers back to the troubleshooting guidance for TLS proxy for those who run polarproxy in TLS forward proxy mode, but also include some basic troubelshooting guidance for running polar proxy in HTTP CONNECT proxy mode.

Once I do that, I want to do a chapter on noise reduction techniques. Like, what are the various ways in which IDS/IPS analysts can reduce false positives from Suricata, reduce the volume of alerts, etc.

I'd also like to do a "Odds and Ends" chapter on interesting use-cases for suricata. This would be the hodge-podge chapter where I can talk about interesting and creative ways that Suricata can be used.

For example, in a previous chapter, we went over the anatomy of a suricata rule, but I wanted to incorporate some writing I've done in the past on how to make flexible suricata rules.

https://community.emergingthreats.net/t/flexible-rule-writing-seeing-around-the-bend/2568

I did a blog post about it, but I want to re-work it into my book to serve it out to a wider audience.

I want to talk about some writing on of my previous co-workers, Brandon Murphy did about how byte_jump, and isdata at can be used to help scope RAT C2 traffic:

https://community.emergingthreats.net/t/the-complexities-of-byte-jump/111

I'd also like to talk about methods of utilizing the ET_INFO ruleset, and how rule writers can make customized rules that are custom tailored to capture data exfiltration in their environments:

https://github.com/da667/Contalks/tree/main/General%20Motors

I want to show readers that the ET INFO ruleset isn't just a bunch of "benign" alerts about common web traffic, but in many cases, if you know what your software inventory is, and what tools/resources your users utilize on a regular basis, how some of these rules can identify changes in behavior and be used for threat hunting.

I also want to talk about iot_hunter, and how it helps automate threat research and generate rules for Iot vulnerabilities rapidly.

I want to talk about some of our regular expressions we use as ET rule writers that help cover a variety of vulnerability classes (e.g. command injection, directory traversal, sql injection, etc.) that the user community can re-use for their own rule writing purposes.

I might consider talking about more subjects if there is any interest from the community or if there are interesting blog posts I've put up in the Emerging Threats community that I want to see make it to a wider audience.

I also want to