In a similar way,
it's really important to understand where these tools
need to be employed or pull data from.
Is the tool pulling from a tap at each of your routers or switches and pushing
that information back to a central location for processing?
In the case of tools like Arkime or ROCK NSM,
that's exactly how that works. And some tools need data pulled from the
endpoints or just the data center for applications,
or more often the case, out here in the ethereal cloud.
So you're going to be provided going in with what the expectation is because
one thing I've had reinforced again and again is that our job as defenders is
100% dependent upon getting the right data from the right devices and
applications and on us doing our jobs right.
That is more than just a requirement for employment.
It's a calling, and in many cases, a moral imperative.
Let me explain what I mean.
It gets glossed over often,
but you cybersecurity operators are working to
protect networks all around the world, day and night,
networks that bring food to people's doors,
protect the sick or vulnerable,
networks that keep planes flying in the right direction,
the money going to the right accounts,
and countless more functions that people depend on from more than just comfort.
Doing your job right isn't a choice.
The purpose of these blue team tools courses and all of
the security apps courses at Pluralsight are to help you
do your job protecting people.
I really hope you enjoyed this series of courses,
and I do have a few notes before you go.
The first is that some tools are so ubiquitous already that we
already have them covered outside of this series.
Some examples are Zeek, formerly Bro, Security Onion,
the NSM Suite, and osquery.
These were recognized as open‑source tools that were already highly adopted
within enterprises and already have one or more courses.
These links lead to those courses and can be found in the
exercise file download on this slide.
And if you happened to miss some of the sources from before,
the MITRE ATT&CK link is here, again,
clickable and spelled out in the exercise files
download containing the slide deck,
as well as the excellent article by Andy Appelbaum that goes into more
detail about mapping MITRE ATT&CK techniques to data sources,
that one is really good, and the link for MITRE Shield's framework.
And last but not least, there's two other intro courses,
one that starts the Red Team Tools path,
which contains the tools used for that emulation function of cybersecurity,
as well as the Security Event Triage path that is full of intermediate to
truly advanced content on continuous monitoring and detection that leverage
exclusively open‑source tools to teach concepts that can be applied across all
platforms for advanced adversary detection.
As always,
thank you so much for joining me here on Pluralsight, and happy hunting.