Finding Traffic Anomalies Using SSL Certificates

Explore innovative techniques for detecting traffic anomalies using SSL certificates in this 37-minute conference talk from the Security Onion Conference 2019. Delve into two distinct detection methods and learn how to enhance SSL logs with additional metadata. Follow along with a live demonstration of a Python script designed for this purpose. Discover the power of dashboards and visualizations in identifying anomalies, and gain insights into various tools and concepts such as J3 Description, PowerShell Bits, Metasploit, and traditional SSL logging. Understand the importance of country codes, UID, and intel sources in network analysis. Equip yourself with valuable knowledge to improve your security monitoring capabilities and detect potential threats more effectively.