Preface

Why, hello there! Welcome to Defensive Security with Kali Purple – a fun-filled educational manual highlighting a unique flavor of the Kali Linux operating system that integrates defensive security tools and applications with the offensive security tools commonly utilized by penetration testers/ethical hackers.

Kali Purple is unique in that it is a suite of interoperable tools that can be used by either offensive or defensive cybersecurity personnel to develop proof-of-concept use cases for educational and training purposes. These tools are organized according to the pillars of the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF).

While we’re providing an introductory manual with high-level overviews, we’ve also included some more advanced concepts and a plethora of bonus resources for those who love to fall down rabbit holes, are frequently unable to determine whether it’s presently dawn or dusk, and have a genuine appreciation for bad dad jokes.

For those who prefer to stay married, we’ve broken the content up into three progressive stages, each with its own group of chapters, so you can digest the material one bit at a time:

• Installation of Kali Purple and tools used to acquire, store, and present information
• Analysis of acquired data for triage and incident response
• Digital forensics, offensive security, and automation

We’ve provided a very brief history of cybersecurity concepts in parallel with cyberattacks, before helping you begin to stand up your own instance of Kali Purple and deploy a Security Information and Event Management (SIEM) system.

We then introduce you to packet and data analysis tools along with intrusion detection and prevention systems. After that, we will progress into what happens after the data is collected, enriched, indexed, stored, and analyzed should it reveal malicious activity – incident response.

We then progress into digital forensics, social engineering, and offensive security, highlighting some of the more popular and well-known tools used by ethical hackers and cybercriminals alike, before wrapping it all up with automation and the NIST framework.