Network Monitoring and Intrusion Detection

Critical vocabulary and concepts related to network security monitoring, intrusion detection systems, and common data analysis tools mentioned in the lecture.

Network Monitoring

The process of collecting and analyzing evidence from network communications to understand activity, detect behavior, and support investigations.

Full Content Data

A type of network security monitoring data that involves capturing every packet in its raw form, similar to a Wireshark capture.

Transaction Data

Summarized versions of full content records, such as those provided by the tool Zeke, that offer a high-level view of network events to save space and simplify analysis.

Extracted Content

Data types consisting of specific files or payloads, such as malware or sensitive files, that have been sent between hosts.

Alert Data

Automated pattern detection mechanisms that flag suspicious activity to allow analysts to investigate a small subset of total network traffic.

Zeke

A passive network analyzer, formerly known as Bro, that categorizes traffic into high-level transaction records and logs like DNS, TLS, and HTTP activity.

Suricata

A signature-based detection tool that uses predefined rules to listen to network traffic and generate alerts when patterns match known malicious activity.

Signature-based Detection

A detection method that looks for well-defined patterns considered to be malicious, generating alerts when those specific patterns are observed.

Anomaly-based Detection

A detection method that establishes a representation of normal behavior and generates alerts when activity deviates from that baseline.

Passive Sensor

A monitoring tool that collects data as it flows through the network without interfering with or blocking the traffic.

Inline Tool

A security mechanism that takes in packets and can actively decide to block traffic deemed malicious, serving as a layer of defense after a firewall.

EDR

Endpoint Detection Response; a security tool that monitors and records processes and activity occurring on individual host machines.

NDR

Network Detection Response; a tool used for identifying high-level malware activities by monitoring network flow traffic.

APT

Advanced Persistent Threat; a sophisticated adversary that attempts to remain undetected in an environment while moving laterally and using specialized tools.

SEEM

A security tool (referred to in the transcript as SEEM or SIEM, such as Splunk) that ingests logs and alerts from multiple sources to provide attack chain visibility.

S0

A connection state code used in Zeke logs to indicate that an initial connection attempt was made but no reply was received.

RSTO

A connection state code in Zeke indicating that a connection was established but was subsequently aborted by the originator.

Nmap

A tool used to simulate or perform service discovery by scanning ports to identify running services and their version numbers.