Tools

Wazuh

Suricata

Security Onion

Splunk

Snort 3

Snort 2

Zeek

pfSense

ELK

UFW/DenyHosts

Windows Firewall

Logging

Windows 10 Security Events

Sysmon

Things to look for

• Nmap/Nessus/Netcat scans
• Change in startup items → registry
• Change in executables