Sguil: Difference between revisions
No edit summary |
No edit summary |
||
| Line 20: | Line 20: | ||
==Setup== | ===Setup=== | ||
==Dependencies== | ===Dependencies=== | ||
==Examples== | ===Examples=== | ||
==Summary== | ==Summary== | ||
Revision as of 16:50, 6 June 2016
Author: Kustas Kurval
Cyber Security Engineering C11
Written 06.06.2016
Introduction
This tutorial was made to introduce Sguil. Sguil (pronounced sgweel) is built by network security analysts for network security analysts. Sguil's main component is an intuitive GUI that provides access to realtime events, session data, and raw packet captures. Sguil facilitates the practice of Network Security Monitoring and event driven analysis.
The Sguil client is written in tcl / tk and can be run on any operating system that supports tcl / tk (including Linux, *BSD, Solaris, MacOS, and Win32).
It is provided by Q Public License
In this introduction I will be covering Sguil in Xbuntu. You will need to know basic Linux syntax and terminology also some terminology concerning overall intrusion detection and prevention systems (IDPS) and overall basic networking.
