Network Security Analyst cheat sheet

OSI mapping for triage: ARP and MAC filtering sit at Layer 2; IP, ICMP, and fragmentation at Layer 3; TCP/UDP ports and SYN floods at Layer 4; TLS and DNS-over-TLS at Layers 5-7.

TCP flag decision rule: SYN without ACK opens a connection; SYN+ACK is the server reply; RST terminates; a scan sending FIN, NULL, or XMAS flags is used to evade stateless filters because closed ports reply RST while open ports stay silent.

Three-way handshake states: SYN-SENT, SYN-RECEIVED, ESTABLISHED. A high count of half-open connections from many sources to one destination indicates a SYN flood rather than load.

CIDR arithmetic: usable hosts = 2^(32 - prefix) - 2 for IPv4; /24 = 254 hosts, /25 = 126, /26 = 62, /30 = 2. /31 is point-to-point with 2 addresses and no broadcast.

Private ranges: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16; link-local 169.254.0.0/16 (APIPA, indicates failed DHCP); loopback 127.0.0.0/8.

NAT and firewall state: stateful inspection tracks the 5-tuple (src IP, dst IP, src port, dst port, protocol); stateless ACLs must permit return traffic explicitly.

IPsec modes: transport mode encrypts payload only (host-to-host); tunnel mode encrypts the entire packet (gateway-to-gateway). ESP provides confidentiality and integrity; AH provides integrity only and fails behind NAT.

TLS handshake facts: certificate chain validated to a trusted root, SNI sent in cleartext in TLS 1.2 and earlier, TLS 1.3 encrypts the certificate; forward secrecy comes from ephemeral ECDHE key exchange.

IDS placement rule: network TAP or SPAN port sees traffic but cannot block; inline IPS can drop. A SPAN port drops frames exceeding its bandwidth, so missed detections on saturated links are an artifact, not absence of attack.

Signature vs anomaly: signature detection matches known patterns with low false positives but no zero-day coverage; anomaly/behavioral detection baselines normal and flags deviation, producing higher false positives.

Alert triage formula: priority rises with severity x asset criticality x confidence; a low-severity alert on a domain controller outranks a high-severity alert on an isolated test host.

Common detection signatures: port scan = one source hitting many destination ports; beaconing = periodic connections at near-constant intervals with low jitter; data exfiltration = outbound volume exceeding baseline to unusual destinations.

Log sources and what they prove: NetFlow/IPFIX gives metadata (who talked to whom, how much) but not payload; full packet capture gives payload; DNS logs reveal resolution attempts including failed ones.

Syslog severity: 0 emergency, 1 alert, 2 critical, 3 error, 4 warning, 5 notice, 6 informational, 7 debug. Lower number = higher severity.

False positive vs false negative: FP is a benign event flagged as malicious (costs analyst time); FN is a malicious event not flagged (costs a breach). Tuning that reduces FP can raise FN.

Encrypted traffic indicators: JA3/JA3S fingerprints identify client/server TLS stacks; self-signed or mismatched certificates and rare JA3 values are detection signals even without decryption.

NIST SP 800-61 lifecycle: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-Incident Activity. Containment precedes eradication, not the reverse.

Evidence order of volatility (RFC 3227, highest first): CPU registers and cache, RAM, swap/pagefile, network state and processes, disk, remote logs, archival media.

Chain of custody requires: who collected, when, where, and how; hash the image (SHA-256) at acquisition and re-verify before analysis; work on copies, never originals.

Containment choices: network isolation preserves evidence and stops spread but may tip off the attacker; account disablement stops access but destroys session evidence; full reimage guarantees removal but loses forensic artifacts.

Indicator categories: atomic (IP, domain, file hash) are easy to change; behavioral (TTPs such as credential dumping then lateral SMB) are durable and map to MITRE ATT&CK.

MITRE ATT&CK tactic order in a typical intrusion: Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Impact.

Malware triage order: identify hash, check reputation, examine strings and imports, observe sandbox behavior, then attribute capability (persistence mechanism, C2 protocol) before scoping.

Breach notification clocks vary by jurisdiction and contract; regulatory deadlines (for example GDPR 72 hours to the supervisory authority) run from awareness, so timestamp the moment of confirmed discovery.

SOC tier model: Tier 1 triage and ticket creation; Tier 2 investigation and containment; Tier 3 hunting, malware reverse engineering, and detection engineering.

Key SOC metrics: MTTD (mean time to detect), MTTA (acknowledge), MTTR (respond/resolve), alert-to-ticket ratio, false positive rate, and percentage of alerts closed within SLA.

Escalation criteria typically include: confirmed compromise of a critical asset, data exposure, ransomware behavior, or an incident exceeding the analyst's authority or SLA window.

Incident report structure: summary, timeline (UTC timestamps), affected assets and data classification, root cause, containment and recovery actions, indicators, and recommendations.

Severity matrix rule: severity derives from impact (confidentiality, integrity, availability, regulatory) combined with likelihood; a confirmed exfiltration of regulated data is at minimum high severity regardless of volume.

Detection engineering loop: hypothesis, data source validation, rule authoring, backtesting against historical data, deployment, then tuning on false positives and coverage gaps.

Threat intelligence tiers: strategic (trends for leadership), operational (campaigns and actor TTPs), tactical (IOCs for tooling). Feed IOCs expire; TTPs age slower.

Compliance reporting distinction: an audit log proves an action occurred; a monitoring report proves it was reviewed. Auditors require both evidence of logging and evidence of review.