Skip to content

Defensive Tooling

The defender's toolbox. Detection rules, firewalling, flow analysis and forensics - used to catch, block and reconstruct the attacks from the other sections.

Modules

  • IDS rule harness - Write Snort/Suricata rules and trigger them with the PoC traffic. (netlab-ids)
  • Firewall policy - nftables/iptables policy and validation that it blocks the PoC. (netlab-firewall)
  • NetFlow / IPFIX analysis - Generate and analyze flows for behavioural detection. (netlab-netflow)
  • PCAP forensics - Reconstruct an attack from a capture (blue-team exercise). (netlab-pcap-forensics)
  • TLS inspection proxy - Defensive TLS inspection proxy (SNI filtering, enterprise MITM). (netlab-tls-inspect)
  • MACsec posture check - Audit MACsec posture (encrypted vs cleartext links) on a segment. (netlab-macsec-monitor)