Not Your Grandma's Packet Capture

Just as networks have changed, so too have packet capture solutions. This paper provides examples of packet capture value for investigations, threat detection, and even identifying operational issues.

By

November 1, 2021

Login to download

I consent that SANS may provide my contact information to a third-party sponsor of this white paper, and that the sponsor may contact me to describe their goods and services related to this white paper.

By providing this information, you agree to the processing of your personal data by SANS as described in our Privacy Policy.

All papers are copyrighted. No re-posting of papers is permitted

Sponsored By

Related Webcast

Not Your Grandma’s Packet Capture!

Just as networks have changed, so too have packet capture solutions. Modern packet capture solutions can identify the traffic that analysts can't decrypt and stop storing additional traffic to increase retention. Some can even send traffic to other devices that can ingest packet capture data,...

Related Content

Purple Team, Offensive Operations

Purple Teaming and Threat-Informed Detection Engineering

In the first two webcasts of this Purple Team series, we covered how to run your first Purple Team Exercise and how to Operationalize your Purple Team. You may have noticed that a common process in Purple Teaming is detection engineering. In this blog, we go into the items discussed in our third...

Jorge Orchilles

Purple Team, Offensive Operations

Building an Internal Red Team? Go Purple First

If you are asked to build an internal red team program today, start with a Purple Team Exercise to foster collaboration across stakeholders early on.

Jorge Orchilles

Offensive Operations, Purple Team, Digital Forensics, Incident Response & Threat Hunting

Cyber Kill Chain, MITRE ATT&CK, and Purple Team

Understanding how attacks work is critical for defense. It's a common theme in SANS Purple Team courses: offense informs defense and defense informs.

Jorge Orchilles