Zone Architecture:
├── DMZ (public-facing services)
│   ├── Web servers, reverse proxies, WAF
│   └── Rules: Internet → DMZ (443/80 only), DMZ → Internal (specific APIs)
├── Internal/Corporate
│   ├── User workstations, corporate apps
│   └── Rules: Internal → Internet via proxy, Internal → DMZ limited
├── Server/Data Center
│   ├── Databases, application servers, file servers
│   └── Rules: No direct internet, accessed from Internal via specific ports
├── Management
│   ├── Jump hosts, SIEM, backup, patch management
│   └── Rules: Mgmt → All (SSH/RDP/SNMP), No inbound except from PAW
├── OT/SCADA (if applicable)
│   ├── PLCs, HMIs, historians
│   └── Rules: Air-gapped or data diode from IT
└── Guest/IoT
    ├── Guest Wi-Fi, IoT devices, BYOD
    └── Rules: Internet only, no access to any internal zone

Micro-segmentation:
├── Label-based policies (Cilium, Calico for K8s)
├── Per-workload firewall rules
├── East-west traffic inspection
└── Default deny between all workloads

# /etc/suricata/suricata.yaml key settings
af-packet:
  - interface: eth0
    threads: auto
    cluster-type: cluster_flow

rule-files:
  - suricata.rules
  - /var/lib/suricata/rules/et-open/*.rules

outputs:
  - eve-log:
      enabled: yes
      types:
        - alert
        - dns
        - http
        - tls
        - flow

# Custom rule examples:
# Detect reverse shell
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"Reverse shell detected"; flow:established,to_server; content:"/bin/sh"; content:"-i"; sid:1000001; rev:1;)

# Detect DNS tunneling
alert dns any any -> any any (msg:"DNS tunneling - high entropy query"; dns.query; content:"|00|"; pcre:"/^[a-z0-9]{30,}\./i"; sid:1000002; rev:1;)

# Detect Cobalt Strike default cert
alert tls any any -> any any (msg:"Cobalt Strike default TLS cert"; tls.cert_subject; content:"Major Cobalt Strike"; sid:1000003; rev:1;)

# DNSSEC validation check
dig @8.8.8.8 example.com +dnssec +short
delv @8.8.8.8 example.com

# DNS-over-HTTPS (DoH) configuration
# Unbound resolver with DoH upstream
server:
  tls-cert-bundle: /etc/ssl/certs/ca-certificates.crt
forward-zone:
  name: "."
  forward-tls-upstream: yes
  forward-addr: 1.1.1.1@853#cloudflare-dns.com
  forward-addr: 1.0.0.1@853#cloudflare-dns.com

# DNS sinkholing for threat intel
# Add malicious domains to DNS blackhole
echo "local-zone: \"malware-c2.com\" redirect" >> /etc/unbound/unbound.conf
echo "local-data: \"malware-c2.com A 0.0.0.0\"" >> /etc/unbound/unbound.conf

# DNS query logging for threat hunting
# Zeek dns.log analysis
cat dns.log | zeek-cut query | sort | uniq -c | sort -rn | head -50
# Look for: high frequency queries, long domain names, TXT record abuse

ZTNA principles:
├── No implicit trust based on network location
├── Every access request authenticated + authorized + encrypted
├── Micro-perimeter around each application (not network segment)
├── Continuous verification (not just at connection time)
└── Least privilege access per session

Components:
├── Identity-aware proxy (BeyondCorp model)
├── Software-defined perimeter (SDP)
├── Device trust posture (compliance, patch level, EDR status)
├── Application-level access (not network-level VPN)
└── Continuous risk assessment during session

Migration from VPN to ZTNA:
1. Inventory all applications accessed via VPN
2. Deploy identity-aware proxy for web applications first
3. Implement device trust verification
4. Migrate non-web apps to SDP/ZTNA broker
5. Decommission traditional VPN (last)

# PCAP capture for investigation
tcpdump -i eth0 -w evidence.pcap -C 100M -Z root host $SUSPECT_IP

# Zeek analysis
zeek -r evidence.pcap local
# Review: conn.log, dns.log, http.log, ssl.log, files.log

# Extract files from PCAP
zeek -r evidence.pcap extract-all-files.zeek
# Files saved to extract_files/ directory

# Network flow analysis
nfdump -r nfcapd.* -s srcip/bytes -n 20  # Top talkers
nfdump -r nfcapd.* -s dstport/flows -n 20  # Top destination ports

# TLS certificate analysis
zeek-cut -d ts id.orig_h id.resp_h server_name < ssl.log | sort -u