1.2 Lịch sử hình thành..................................................................................32
2. Thành phần cốt lõi..........................................................................................33
2.1 Giám sát hệ thống mạng...............................................................................33
2.1.1 Phát hiện xâm nhập..............................................................................33
2.1.2 Siêu dữ liệu mạng ( Network Metadata )............................................34
2.3 Các công cụ phân tích...................................................................................39
2.3.1 Giao diện SOC.....................................................................................39
2.3.2 Kibana..................................................................................................40
2.3.3 Elastic Fleet..........................................................................................41
2.3.4 Osquery Fleet.......................................................................................41
2.3.5 InfluxDB..............................................................................................42
2.3.6 Hunt......................................................................................................43
2.3.7 CyberChef............................................................................................44
2.3.8 CAPME................................................................................................45
2.3.9 Squert...................................................................................................46
2.3.10 Sguil...................................................................................................47
2.3.11 Wireshark...........................................................................................48
2.3.12 Các công cụ NIDS..............................................................................48
2.4 Yêu cầu hạ tầng.............................................................................................50
2.5 Kiến Trúc......................................................................................................52
2.5.1 Import...................................................................................................52
2.5.2 Evaluation............................................................................................52
2.5.3 Standalone............................................................................................53
2.5.4 Distributed............................................................................................54
2.5.5 Note Types...........................................................................................56
2.6 Triển khai Security Onions...........................................................................57
2.7.1 Đánh giá chung giữa Cisco Systems và Security Onion......................58
2.7.2 Đánh giá nổi bật của khách hàng.........................................................60
2
