Network Traffic and Log Monitoring and Analysis
Collection sources
Monitoring depends on knowing what each source can and cannot tell you. Full packet capture (SPAN port or network TAP) gives payload and is the deepest but most storage-intensive option; flow records (NetFlow/IPFIX, sFlow) give metadata - source, destination, ports, bytes, timestamps - but no payload; logs (syslog, Windows Event Forwarding, application logs) give host and service context. Agents such as EDR add process, file, and registry telemetry that network data cannot see.
Detection approaches are signature-based (known bad patterns, low false positives but no zero-day coverage) versus anomaly/behavior-based (baselining normal, catching deviations, higher false positives). A SIEM normalizes and correlates across sources but depends on accurate time via NTP, tuned rules, and adequate retention.
Log specifics worth memorizing
Windows Security log: 4624 successful logon, 4625 failed logon, 4634 logoff, 4648 explicit credential use, 4672 special privileges assigned, 4720 account created, 4728 account added to a privileged group, 4740 account lockout, 1102 audit log cleared, and System log 7045 for a new service. Linux: /var/log/auth.log (Debian-family) or /var/log/secure (RHEL-family) for authentication, plus cron, syslog, and auditd.
Traps
NetFlow cannot reveal file contents or payload strings. A 4625 burst is not proof of compromise - it may be lockout or a password spray; correlation with 4624 and 4720 is needed. And a cleared log (1102) is itself an alert, not benign maintenance.
Rule of thumb
Before choosing a tool, decide whether you need payload, metadata, or host context; then ask whether the question wants detection (signature/anomaly) or response (SIEM correlation and alerting).