Snort Intrusion Detection, Rule Writing, and PCAP Analysis (Udemy.com)

it was almost the same as the network security course, not really adding too much new. some lessons were repeated or the exact same from the network security course by same Proffesor

This course is perfect false advertising, even though it probably doesn't mean to be. First, unless you hunt down an EOL version of Security Onion, you can't follow along, and the fact that it's been EOL for years now with no course update is telling. Second, there is no explanation for what you're doing. Using real world examples is great, however you don't get any "why" behind the thought process and working through the problems. The instructor just takes a problem, works through it, and doesn't give you any insight into why he's doing these things. You don't even really learn how to write Snort rules, he doesn't go over the format beyond the very basics, or the difference between a great rule and a poor one. You don't learn actual PCAP analysis, he just opens one, finds the bad stuff (without explanation), and says "yep here it is". It's easy if you know what you're doing or what you're looking for. I'd expect a course that says they will teach you analysis to explain some foundational concepts so you can actually learn to do it yourself.

Not for beginner

Course was good and delivered what it said it would - steps were easy to follow and could be replicated. Instructor is clear and knowledgeable. I would have liked some next steps as I feel I have just got started and I'm not sure what to do next.

Did not explain the components of the rules, their purpose, order, and things that usually go wrong during rule writing. Was expecting to see some comparison with suricata rule structure, also some info around ET pro ruleset, Talos rule set etc. A section for the basics would make this course close to complete.

ok

Good for intermediate.

Great!

Great course. In my opinion the biggest advantage is showing everything from scratch - even vm image installation is not skipped. The only thing I could be changed is ordering - before writing multiline rules it would be good to explain basic structure of snort rule. Without this there may be a little confusion in the beginning.

Maybe go a little slower in pace and speech for those of trying to get up to speed or new to networks? Otherwise great. Excellent to see step by step instructions and clear screen views.

This is like studying in an encyclopedia. No instructions, no explanations, just rambling the detail of each command. Need to EXPLAIN these things and not just ramble ever onward.

It was a fascinating first look at Snort and Security Onion. Instructor moved very quickly and I could have used more information about the syntax of Snort rule writing.