Analyst Tools
Links are version-pinned where the vendor publishes per-version documentation. Wazuh and Suricata both do, and the pinned URLs below match the version authority for this edition. Consulting a newer version’s documentation is a common source of syntax that looks correct and does not work against the build in this lab.
| Tool | Publication | URL |
|---|---|---|
| Wazuh | Wazuh 4.14 documentation | https://documentation.wazuh.com/4.14/ |
| Suricata | Suricata 8.0.6 documentation | https://docs.suricata.io/en/suricata-8.0.6/ |
| Emerging Threats Open | ET Open ruleset | https://rules.emergingthreats.net/open/ |
| MITRE ATT&CK | MITRE ATT&CK Enterprise | https://attack.mitre.org/ |
| Auditd | Linux Audit — auditd(8) | https://man7.org/linux/man-pages/man8/auditd.8.html |
| tcpdump | tcpdump(1) manual | https://www.tcpdump.org/manpages/tcpdump.1.html |
| Nmap | Nmap Reference Guide | https://nmap.org/book/man.html |
| jq | jq manual | https://jqlang.org/manual/ |
| xxd | xxd(1) manual | https://man.archlinux.org/man/xxd.1 |
| NuShell | Nushell Book | https://www.nushell.sh/book/ |
| Volatility 3 | Volatility 3 documentation | https://volatility3.readthedocs.io/en/stable/ |
| Sysmon | Sysmon (Sysinternals) | https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon |
| Sysinternals | Sysinternals documentation | https://learn.microsoft.com/en-us/sysinternals/ |
| Windows Event Logs | Windows Event Log (Win32) | https://learn.microsoft.com/en-us/windows/win32/wes/windows-event-log |
| Windows Defender | Microsoft Defender Antivirus | https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-antivirus-windows |
| NetworkMiner | NetResec NetworkMiner | https://www.netresec.com/?page=NetworkMiner |
| Zimmerman Tools | Eric Zimmerman’s Tools · documentation | https://ericzimmerman.github.io/documentation/ |
| OpenSSH | OpenSSH manual pages | https://www.openssh.com/manual.html |
| curl | curl manual (curl.1) | https://curl.se/docs/manpage.html |
| Python 3.13 + pip | Python 3 documentation | https://docs.python.org/3/ |
| Osquery | osquery documentation | https://osquery.readthedocs.io/en/stable/ |
| Wireshark / tshark | Wireshark documentation | https://www.wireshark.org/docs/ |
| YARA | YARA documentation | https://yara.readthedocs.io/en/stable/ |
Note. All links were verified reachable at the time this edition was assembled. Where a vendor reorganizes its documentation, search the tool name together with the pinned version rather than editing the URL path by hand.