Network Monitoring, SIEM, and Threat Detection

Vocabulary flashcards covering network monitoring concepts, incident response terminology, SIEM architecture, and detection technologies (IDS, IPS, EDR).

Network traffic

The amount of data that moves across a network, which can also include the specific type of data transferred, such as HTTP.

Network data

The data that is transmitted between devices on a network.

Network monitoring

The ongoing collection and analysis of network traffic to maintain situational awareness of network activity and detect suspicious behavior.

Baseline

A reference point used for comparison to establish a standard of expected or normal behavior for systems, devices, and networks.

Flow analysis

The examination of the movement of network communications, which includes information related to packets, protocols, and ports.

Port

A network component that receives and transmits communications, often associated with specific network protocols (for example, port 443 with HTTPS).

Command and control (C2)

Techniques used by malicious actors to maintain communications between compromised systems and their own machine, often by mismatched protocols and ports (such as HTTPS over port 8088).

Packet payload information

The actual data transmitted within a network packet (excluding transmission headers like IP addresses), which is often encrypted and can be analyzed to identify data exfiltration attacks.

Temporal patterns

Time-related patterns within network packets used to understand normal traffic volume hours (such as 9 a.m. to 5 p.m.) and detect off-baseline anomalies.

Network operations center (NOC)

An organizational unit that monitors network performance and responds to disruptions, such as network outages, to maintain performance, availability, and uptime.

Security operations center (SOC)

An organizational unit dedicated to monitoring networks, systems, and devices against security threats or attacks through threat detection and response.

Indicators of compromise (IoC)

Signs of potential security incidents that security analysts monitor network traffic to detect.

Network protocol analyzers (packet sniffers)

Tools designed to capture and analyze data traffic within a network in detail, such as tcpdump and Wireshark, which record network communications through packet captures.

Computer security incident response team (CSIRT)

A specialized group of security professionals trained in incident management and response.

Documentation

Any form of recorded content that is used for a specific purpose.

Event

An observable occurrence on a network, system, or device.

Incident

An occurrence that actually or imminently jeopardizes, without lawful authority, the confidentiality, integrity, or availability of information or an information system; or constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.

Incident handler’s journal

A form of documentation used by professionals during incident response.

Incident response plan

A document outlining the procedures to take in each step of incident response.

NIST Incident Response Lifecycle

A four-phase incident response framework published by the National Institute of Standards and Technology consisting of: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-incident activity.

Playbook

A manual that provides details about any operational action.

Security orchestration, automation, and response (SOAR)

A collection of applications, tools, and workflows that uses automation to respond to security events.

Security information and event management (SIEM)

An application that collects, aggregates, normalizes, and analyzes log data across devices to provide real-time monitoring, alerting, access to event data, and historical log storage.

Log analysis

The process of examining log records to identify events of interest.

Logs

Records of events that occur within an organization’s systems, detailing information such as timestamps and IP addresses.

Aggregation (SIEM)

The process of consolidating log data collected from various sources, such as firewalls, servers, and routers, into a single centralized location.

Parsing

The extraction and mapping of log data into distinct fields and their corresponding values (such as host, process, source user, source IP, and source port) to make logs easier to read and interpret.

Normalization

The process of converting collected event data from varied source formats into a single, standardized, structured format that is easily searchable.

Correlation (SIEM)

The comparison of multiple log events to identify common patterns indicating potential security threats.

Intrusion detection system (IDS)

An application that continuously monitors system and network activity, logs activity, and generates alerts on possible intrusions, but does not stop or prevent the activity (examples include Zeek, Suricata, Snort, and Sagan).

Intrusion prevention system (IPS)

An application that monitors system activity for intrusive activity, logs events, generates alerts, and actively takes action to stop the activity, such as modifying router access control lists (examples include Suricata, Snort, and Sagan).

Endpoint detection and response (EDR)

An application installed on endpoints that monitors, records, logs, and alerts on system activity, applies AI/ML behavioral analysis to detect threat patterns, and automatically stops attacks without manual intervention (examples include Open EDR, Bitdefender Endpoint Detection and Response, and FortiEDR).

Endpoint

Any device connected on a network, including end-user devices such as computers, phones, and tablets.

Behavioral analysis

The application of machine learning and artificial intelligence to analyze endpoint system behavior and identify malicious or unusual threat patterns.

True positive

An alert that correctly detects the presence of an attack.

True negative

A state where no malicious activity exists and no alert is triggered.

False positive

An alert that incorrectly detects the presence of a threat when the activity is actually benign.

False negative

A dangerous state where malicious activity occurs but the detection system fails to detect it, leaving the security team unaware of the attack.