Timestamp Drift, Truncated Alerts, and a 3.2 GB Egress on the Night Shift
At 23:42 a Tier-1 analyst at a discrete manufacturer faces 312 queued IDS alerts, but only 40 retain full session metadata; the rest were truncated when the sensor buffer rolled over. Two IDS sensors in the OT DMZ report timestamps 47 minutes behind the SIEM indexer because their NTP source is an isolated plant domain controller, so alert ordering in the console is unreliable. A firewall record shows 3.2 GB leaving the corporate segment to an unfamiliar ASN between 02:15 and 02:51 local time, yet the proxy log has no matching session, because the proxy sits behind a load balancer that records only the balancer address and its session table has already aged out. A new span-port sensor installed nine days ago has never been added to the asset inventory and is capturing traffic the monitoring team believes is invisible. The shift supervisor asks for a handoff note in twenty minutes.
1. The analyst can only resolve one discrepancy before shift end. Which one, and how does the choice change the classification of the 3.2 GB transfer?
Read the worked answer
The proxy and load balancer masking is the blocker, not the clock skew.
- Clock skew changes when things happened, not whether bytes left. A 47-minute offset corrupts the timeline and could make an IDS alert appear to postdate the transfer, so it must be corrected before any causal narrative is written. But the firewall record already proves 3.2 GB egressed.
- The load balancer logs only its own address as the client, so the proxy cannot attribute the session to an internal host. That is the only remaining path from 'bytes left' to 'which machine sent them'.
- Pull the load balancer access logs and any X-Forwarded-For header the proxy preserves, correlate with NAT translations and DHCP leases for 02:15-02:51, and pivot on NetFlow if the firewall exports it.
- The rolled-over sensor buffer and the un-onboarded span port reduce fidelity but do not prevent attribution.
Until that correlation is done the classification is unattributed egress, not exfiltration.
2. The supervisor wants to block the destination ASN at the perimeter. Argue for or against, and state the conditions that would change your answer.
Read the worked answer
Against, as stated. An ASN block is blunt: shared and cloud ranges routinely host partners, SaaS tenants and CDNs, so a blanket block can break business traffic while an adversary rotates to another range within hours.
Reasoning:
- The transfer completed roughly 21 hours ago. A perimeter block prevents re-contact; it does not contain the loss.
- First check whether other internal hosts have talked to that ASN in the last 30 days. If several have, a block hides ongoing activity you need to observe.
- Preferred: block the specific /32s seen in the firewall log, alert on any future connection to the ASN, and keep the flow visible for a defined observation window.
- Block immediately instead if an independent source confirms the destination as C2, or if a host is still actively beaconing.
Record the decision and the observation window either way, so the next shift knows the block was deliberate and time-boxed.
3. Write the escalation. What severity, and what must be preserved before retention expires?
Read the worked answer
Severity high: potential data exfiltration with unknown initial access. Escalate to Tier 2 or IR, not to a ticket queue.
Justification: 3.2 GB is not consistent with normal traffic on that segment, the timing is outside business hours, and attribution is currently impossible, which means compromise cannot be ruled out. Unattributed egress of that volume is exactly the case where waiting for certainty is the wrong trade.
Preserve before retention expires:
- Firewall session and NAT logs for 02:00-03:00, exported and hashed.
- Load balancer access logs for the same window.
- DHCP leases covering the source segment.
- The un-onboarded sensor's capture, plus a note that it is absent from inventory.
- Current NTP offset measurements on both DMZ sensors, so a later reviewer can correct the timeline.
Do not reboot or upgrade the sensor, load balancer or indexer before those exports complete. State in the handoff which of these the night shift actually finished.