mod6 C02_M06 Module Conclusion links ../C02_M06/assets/coursemap.swf courseMenuBtn Course menu Course menu. Select this button to access the course menu. MainMenuButtonClicked moduleMapBtn Lesson Map Lesson Map. Select this button to access the lesson map. CourseMapButtonClicked glossaryBtn Glossary Glossary. Select this button open the glossary. GlossaryButtonClicked resourcesBtn Resources Resources. Select this button open the resources. ResourcesButtonClicked exitBtn Exit Exit. Select this button to exit the course. ExitButtonClicked replayBtn Replay Replay. Select this button to replay the current screen. ReplayButtonClicked pauseBtn Pause Pause. Select this button to pause the course. PauseButtonClicked resumeBtn Resume Resume. Select this button to resume the course. ResumeButtonClicked previousPgBtn Previous Page Previous. Select this button to go to the previous screen. PreviousButtonClicked nextPgBtn Next Page Next. Select this button to go to the next screen. NextButtonClicked disaidscr6_01 1 In this lesson we will review what you have learned in this module. The NIDS rules fundamentals lesson discussed Snort , NIDS rule components, rule header details, and rule options. The rule header details include action and protocol. The rule option details consist of message, content, and class type. Finally you created an example NIDS custom rule. In order to further define what data to monitor, the advanced rules lesson presented payload rule options: offset, depth, distance, within, and nocase; and non-payload rule options: flow and established. The NIDS rule optimization lesson focused on the benefits and liabilities of using specific options and modifiers in writing your custom rules, their impact upon the NIDS and network, and correlating NIDS data with tags and logs. The final lesson discussed detecting worms and data exfiltration. This lesson includes the stages of a worm/bot attack, the most effective way to detect worm/bot attack with your NIDS, and tips to leverage your NIDS to detect data exfiltration. Rich Media Text Description, Course: D O D Intrusion Detection System (I D S) Analysis, Part 3, Module 2: DoD Network Intrusion Detection System (NIDS) Custom Rules Module, Lesson 6: Course Conclusion, For each screen you will hear a description. The description is cued by an audio tone. Listen to the description, and then select the play audio narration button to continue. Screen 1 of 2. Lesson title: Module Conclusion. Topic title: Summary and Conclusion. Screen title: Summary. Four images are displayed. The first image, labeled NIDS rules fundamentals, shows the snort logo super imposed over a snort rule. The second image, labeled NIDS advanced rules, shows a user computer and server with arrows representing connections. The third image, labeled NIDS rule optimization, shows a reprise of the tight rope walker. The fourth and final image, labeled detecting worms and data exfiltration, shows the bots, worms and email icons super imposed on the malicious actor. Text displays, Module Summary. A text box displays that states: References to open source or freeware in this training product are for training purposes only, and should not be considered endorsements of these products. Please check with your command, service or agency for guidance on the use of these products. disaidscr6_02 2 Congratulations! You have completed the DoD Network Intrusion Detection Systems Custom Rules module. You should now be able to identify considerations for writing NIDS rules within a government or military environment. You should be able to write a simple NIDS rule using a defined outcome. You also should be able to write complex NIDS rules using modifiers for a defined outcome and write complex rules using tag options for a defined outcome. Finally, you should be able to write a NIDS rule using advanced detection capabilities. Screen 2 of 2. Screen title: Conclusion. Text, Congratulations displays. Text displays in support of audio. Objectives bullets change to checkmarks in sync with audio.