This page contains tutorials, analyses and challenges done on IT & Cybersecurity datasets using Squey.

AWS VPC Flow Logs

• Visualize AWS VPC Flow Logs in Squey using Apache Parquet format

DNS

• MACCDC 2012 DNS Challenge (from PentesterAcademy)

PCAP

• DFIR MONTEREY 2015 Network Forensics Challenge (from Netresec)
• Filter PCAPs using complex criteria

Proxy

• bluecoat_proxy_big Analysis (from Public Security Log Sharing)
• Phishing attack detection (video)

SSH

• Detect a login after social engineering (from Detecteam)

In this section

• Bluecoat Proxy Big Analysis
  A step-by-step tutorial to load and analyze a large Bluecoat proxy logs dataset in Squey with parallel coordinates, format parsing and bandwidth aggregation.
• Detect an SSH login after social engineering
  Detect a compromised SSH account in one year of OpenSSH logs with Squey, spotting suspicious logins by time and location using parallel coordinates.
• DFIR MONTEREY 2015 Network Forensics Challenge
  Solve DFIR Monterey 2015 Network Forensics Challenge PCAP questions in Squey with parallel coordinates and Python to reveal malware beaconing.
• Filter PCAPs using complex criteria
  Learn how to filter large PCAP captures in Squey with complex criteria using parallel coordinates, then export isolated packets and TCP streams to PCAP files.
• PentesterAcademy MACCDC 2012 DNS Challenge
  Solve the PentesterAcademy MACCDC 2012 DNS challenge in Squey by analyzing DNS logs with distinct values to find top domains, NXDOMAIN and reverse lookups.
• Phishing attack detection in proxy logs
  Watch a video showing the detection of a successful phishing attack hidden in 10 million rows of anonymized proxy logs using Squey.
• Visualize AWS VPC Flow Logs in Squey using Apache Parquet format
  Import AWS VPC Flow Logs stored in Apache Parquet format into Squey 5.0 to visualize network traffic, understand patterns and identify security issues.