Active Sensors
Now that your network is segmented, you need to actively monitor it to detect suspicious activities and potential threats and take actions based on that. Your security posture won’t be fully completed if you don’t have a good detection system; this means having the right sensors distributed across the network, monitoring the activities. The Blue Team should take advantage of modern detection technologies that create a profile of the user and computer in order to better understand anomalies and deviations in normal operations. With this information, preventative actions could be taken.
In this chapter, we are going to cover the following topics:
- Detection capabilities
- Intrusion detection systems
- Intrusion prevention systems
- Behavior analytics on-premises
- Behavior analytics in a hybrid cloud
We’ll start by discussing the importance of detection systems and what they can provide.
