Network Security Monitoring and Analysis
Network Security Monitoring and Analysis
This domain tests whether you can use network evidence to detect, scope, and explain an incident. Questions often give you flow records, packet captures, IDS alerts, or proxy logs and ask what the traffic proves and what to do next.
Core rules and concepts
- NSM combines full packet capture, flow data such as NetFlow/IPFIX, transaction logs, and alert data. Each answers a different question: PCAP for content, flow for scope, logs for context.
- Monitor east-west traffic, not just the perimeter. Lateral movement, SMB scans, and internal C2 often avoid edge devices.
- IDS signatures detect known patterns; anomaly detection flags deviations. Both need tuning and analyst validation.
- Read TCP flags and session state carefully: SYN scans, RST floods, and established sessions tell different stories. DNS, TLS metadata, and proxy logs can reveal beaconing without payload decryption.
- Time synchronization matters. Correlate timestamps across sensors and endpoints in a consistent time zone.
Worked example
A flow record shows one internal host making SMB connections to 200 hosts in 80 seconds, and an IDS alert reports a lateral-movement tool. Reasoning: this is likely internal scanning or worm-like spread. Use flow data to identify the source and scope, then PCAP to confirm SMB negotiation and any file transfer. Check endpoint logs for the process that initiated the connections. Contain the source host, block the account or service used, and search other subnets for the same pattern. Do not conclude compromise from the IDS alert alone; corroborate with flow and host evidence.
Traps
Do not rely on perimeter alerts only; do not ignore east-west traffic; do not mix time zones; do not assume encrypted traffic is invisible when metadata still shows patterns.