Investigating Network Flows and Security Solutions Alerts
In most digital networks, there are network devices such as routers that generate flows and security solutions that generate security alerts. That information and data are useful to detect and investigate various cyber threats. As an SOC analyst, you should be aware and take advantage of the flow metadata provided by network devices such as routers and layer 3 switches, and the alerts generated by security solutions such as Antivirus (AV), Endpoint Detection and Response (EDR), an Intrusion Prevention System (IPS), an Intrusion Detection System (IDS), a network sandbox, and a network AV.
The objective of this chapter is to learn how to detect and investigate cyber threats by utilizing the flow metadata provided by network devices such as routers and layer 3 switches, and the alerts generated by security solutions such as AV, EDR, IPS, IDS, a network sandbox, and a network AV.
In this chapter, we’ll cover the following...
