I85PREP
⌘ K
CISP-TRE study materials
CISP-TRE study resources

CISP-TRE: Network Security Monitoring and Traffic Analysis

CISP-TRE · Work through your exam, one topic at a time.

All guide sections

Network Security Monitoring and Traffic Analysis

Network Security Monitoring and Traffic Analysis

This domain tests your ability to find adversary activity in network evidence: full packet capture, flow records, transaction logs and IDS alerts. The exam favours questions where you must choose the right data source for a question, and where you must reason about behaviour rather than match a signature.

Data sources and what each answers

  • Full packet capture answers payload questions but is expensive to store; retention is usually short.
  • Flow records (NetFlow v5/v9, IPFIX) answer who talked to whom, how much and how often; no payload.
  • Transaction logs from Zeek - conn, dns, http, ssl, files - give session metadata with rich fields at a fraction of packet cost.
  • IDS alerts from Suricata or Snort give signature and protocol-anomaly hits; they need triage, not blind trust.
  • Proxy and DNS logs are often the only visibility into encrypted egress.

Behaviours worth detecting

  • Beaconing: regular connection intervals to the same destination with low jitter, small consistent request and response sizes, and repeated sessions at all hours. Compute inter-arrival times and their variance rather than eyeballing a graph.
  • DNS tunnelling: unusually long labels, high entropy in subdomains, high volume of TXT or NULL queries, one parent domain with many unique subdomains.
  • Exfiltration: outbound-to-inbound byte ratio far above the host baseline, transfers to consumer file-sharing or newly registered domains.
  • Encrypted traffic metadata: JA3 and JA3S fingerprints, SNI values, certificate issuer anomalies, self-signed certificates on non-standard ports.

Placement

Perimeter-only monitoring misses east-west movement. Use TAP or SPAN at chokepoints, including server-to-server segments, and account for NAT, asymmetric routing and clock skew when correlating with endpoint logs.

Worked example: Zeek conn.log shows one workstation reaching the same IP every 60 seconds with jitter under 3 seconds, 1,440 sessions per day, roughly equal small byte counts each way, and activity continuing at 03:00 local time while the user is offline. That regularity is machine-generated, not browsing. Pivoting to http.log gives the User-Agent and URI, the ssl.log gives the JA3, and DNS shows the domain was registered days ago. You block the destination, hunt the JA3 and domain across the estate, and image the host.

Traps: assuming NetFlow contains payload; trusting port numbers as protocol identification; concluding benign because traffic is encrypted; ignoring beaconing that uses jitter to look irregular; forgetting NAT when mapping a flow back to a host.