<![CDATA[My suricon talk got accepted]]>My suricon talk got accepted

I'm doing a double-header on some new suricata features I've been messing with recently, along with a discussion on exploit reproduction for detection engineers.

]]>https://board.circlewithadot.net/topic/be4b2887-33bd-486d-9dba-b675f97a7920/my-suricon-talk-got-acceptedRSS for NodeFri, 15 May 2026 06:58:40 GMTWed, 29 Apr 2026 15:39:00 GMT60<![CDATA[Reply to My suricon talk got accepted on Wed, 29 Apr 2026 15:58:58 GMT]]>@da_667
Wing it.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/FritzAdalis/statuses/116488820375281878https://board.circlewithadot.net/post/https://infosec.exchange/users/FritzAdalis/statuses/116488820375281878Wed, 29 Apr 2026 15:58:58 GMT<![CDATA[Reply to My suricon talk got accepted on Wed, 29 Apr 2026 15:57:11 GMT]]>@da_667 congrats!

]]>https://board.circlewithadot.net/post/https://masto.deoan.org/users/neurovagrant/statuses/116488813352427336https://board.circlewithadot.net/post/https://masto.deoan.org/users/neurovagrant/statuses/116488813352427336Wed, 29 Apr 2026 15:57:11 GMT<![CDATA[Reply to My suricon talk got accepted on Wed, 29 Apr 2026 15:54:36 GMT]]>@da_667 LOL. guess what I am doing right now. I will create a 15 slides deck. which my manager will reduce down to 8 slides, his manager down to 4 and at the final presentation it will be one line in someone else's slide deck.

story of our lives 😞

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/Rajiv/statuses/116488803198895566https://board.circlewithadot.net/post/https://infosec.exchange/users/Rajiv/statuses/116488803198895566Wed, 29 Apr 2026 15:54:36 GMT<![CDATA[Reply to My suricon talk got accepted on Wed, 29 Apr 2026 15:53:53 GMT]]>but on the bright side, I get to go to Lisbon, Portugal.

also FUCK. I should probably learn a little bit of Portuguese.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/da_667/statuses/116488800401135634https://board.circlewithadot.net/post/https://infosec.exchange/users/da_667/statuses/116488800401135634Wed, 29 Apr 2026 15:53:53 GMT<![CDATA[Reply to My suricon talk got accepted on Wed, 29 Apr 2026 15:51:09 GMT]]>fuck, now I have to write a slide deck.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/da_667/statuses/116488789657631983https://board.circlewithadot.net/post/https://infosec.exchange/users/da_667/statuses/116488789657631983Wed, 29 Apr 2026 15:51:09 GMT<![CDATA[Reply to My suricon talk got accepted on Wed, 29 Apr 2026 15:45:59 GMT]]>for some of the new features, I definitely want to highlight the availability of websocket protocol support. I also plan on talking about nDPI features, and how the requires keyword will make experimenting with new features in the ET ruleset fairly easy.

The second half of the presentation is a sort of (somewhat) live presentation on some stuff I do when I have access to a proof of concept exploit. What do you do when you have proof of concept code, but don't have easy access to the software or the device that is actually vulnerable? Turns out, getting a pcap for these cases isn't very difficult, and gives you what you need to write rules for it.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/da_667/statuses/116488769320458376https://board.circlewithadot.net/post/https://infosec.exchange/users/da_667/statuses/116488769320458376Wed, 29 Apr 2026 15:45:59 GMT<![CDATA[Reply to My suricon talk got accepted on Wed, 29 Apr 2026 15:43:33 GMT]]>@da_667 W00P W00P

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/gl0ck/statuses/116488759751858713https://board.circlewithadot.net/post/https://infosec.exchange/users/gl0ck/statuses/116488759751858713Wed, 29 Apr 2026 15:43:33 GMT