Nagios Support Forum

I want create querys for Cyber Threat Hunting using the data of NNA.
For example (a stupid example), detect the ping of death with netflow

is there anything done?

This is usually accomplished with queries. Check out this article for more information.
https://support.nagios.com/kb/article/n ... es-74.html

There area a couple of example queries that come with NNA. One of which is checking for common bot net ports being accessed. As long as you know what you're looking for, you should be able to query for it.

Yes, I know
I want more examples (botnets) for use in NNA.
is there more examples?

Hi @alopera,

Please see PM.