Network Security Monitoring and Incident Response
Detection Sources
Know the telemetry: firewall and proxy logs, IDS/IPS alerts, NetFlow, DNS logs, endpoint telemetry, and SIEM correlation. Distinguish signature-based from anomaly-based detection and their false-positive/false-negative trade-offs. Understand that IDS detects and IPS blocks inline.
Incident Response Lifecycle
Master preparation, detection and analysis, containment, eradication, recovery, and lessons learned. Know the difference between containment (stop spread) and eradication (remove cause). Understand evidence handling and chain of custody, and when to preserve volatile data first.
Analysis Techniques
Use baselines to spot anomalies, correlate timestamps (hence NTP), and apply the pyramid of pain or kill-chain framing to prioritize indicators. Know common indicators: beaconing, unusual outbound volumes, DNS tunneling, and privilege escalation events.
Worked Example / Rule of Thumb
On a suspected compromised host, isolate it from the network (containment) before wiping it, and capture volatile evidence (memory, connections) before powering down. Rule: contain first, preserve evidence, then eradicate.
Trap: jumping to 'reimage immediately' skips evidence preservation and may destroy the root cause. Also distinguish detection (alert) from response (action).