Intrusion Detection and Log Analysis
This domain tests detection logic and log correlation. You must distinguish signature-based alerts from behavioral anomalies, explain IDS/IPS placement, and reconstruct an intrusion from multiple log sources.
Core rules
Signature detection matches known patterns and is precise for known threats but blind to novel behavior. Anomaly detection baselines normal traffic and flags deviations, producing more false positives. IDS monitors; IPS blocks inline. Sensor placement determines visibility: perimeter, DMZ, east-west, and cloud VPC flow logs each reveal different activity. Normalize timestamps to UTC and preserve raw logs before parsing.
Useful network sources include firewall denies/allows, proxy URL and user-agent logs, DNS query logs, DHCP leases, VPN authentication, NetFlow, and IDS alerts. Correlate by five-tuple, user, host, and time. A single alert is weak; a sequence-scan, successful connection, beacon, large upload-is stronger. Tune with allowlists and thresholds, but document suppressions.
Worked example
Suricata alerts on a suspicious TLS certificate, while firewall logs show the same internal host connecting to that IP every 60 seconds with 1–2 KB payloads. Proxy logs show no user browsing to the domain, and DHCP maps the IP to a finance workstation. Reasoning: periodic small connections plus a rare certificate suggest command-and-control beaconing, not normal browsing. Escalate and preserve PCAP and host memory before blocking.
Traps
Chasing alert volume instead of evidence; treating a blocked connection as no incident; missing east-west traffic; and ignoring log gaps caused by retention or sensor failure. Also avoid assuming an IDS alert proves compromise.