CFI 2200 - Advanced IDS Techniques

Credits: 3
Hours/Week: Lecture 2 Lab 2
Course Description: This course focuses on deploying security and Intrusion Detection Systems (IDS), logs collections, handling, analytics, and analysis. Our analytical tools will comprise open-source Security Onions, Zeeks, SELKS, and LAMP (Linux, Apache, MySQL, PHP) stacks with a focus on security and Intrusion Detection Systems (IDS). Topics include the installation, configuration, and management of Security Onions, SELKS and LAMP resources, Snort IDS, Zeek IDS, and other threat analytical software IDS-related tools as well as the practical test firing of IDS resources and packets.
MnTC Goals
None

Prerequisite(s): CFI 1085 with a grade of C or higher OR instructor consent.
Corequisite(s): None
Recommendation: None

Major Content

Introduction to Intrusion Detection Systems (IDS’) and Snort
Deployment of Various Intrusion Detection Systems (IDS) tools.
Installation and Configuration of Snort
Snort rules
Analysis of various packets with Zeek
Analysis of packets with various security Onions tools like Kibana
Introduction to Linux, Apache, MySQL and PHP (LAMP) Stacks.
Configuration of lab LAMP stack for basic web server functionality.
Further configuration of lab LAMP stack for full LAMP web server functionality.

Learning Outcomes
At the end of this course, students will be able to:

demonstrate resourcefulness in the deployment of multiple Intrusion Detection systems.
explain the fundamental concepts of Intrusion Detection Systems (IDS).
deploy appropriate strategies in network security monitoring and traffic analysis using Zeek.
explain virtualization basics their relationship to IDS-related resources in a virtual environment.
solve problems related to the deployment and administration of network resources.
use prodlabon labs resources to perform analytics and log analysis.
perform network intrusion analysis from Test Firing engagements using various IDS platforms.
analyze network traffic and find Indications of Compromise (IOC) using various IDS tools.
employ practical knowledge of SQL IDS queries.
configure Linux-based IDS servers in an ESX or Cloud Environment.
apply working knowledge of Snort rules.

Minnesota Transfer Curriculum (MnTC): Goals and Competencies
Competency Goals (MnTC Goals 1-6)
None
Theme Goals (MnTC Goals 7-10)
None

Practicum hours per week: 0

Courses and Registration