Cyberstudy
PDF p.321 In progress

Network Data Sources

Open PDF at p.321 18 flashcards

Summary

PDF p.321

Network appliances generate system and security/audit logs, which are crucial for investigating security incidents. These logs, along with other network security data, help identify and analyze threats.

In plain words

Supplementary — not from your PDF

Routers, switches, firewalls and access points log their status, traffic and access. Switch logs can show one port using several MAC addresses (a possible on-path attack). Firewall logs show blocked connection attempts, such as scans on closed ports, with time, interface, direction, action, addresses and ports. Access point logs record disassociation events. IDS/IPS logs record rule matches and responses (shuns, resets, redirects) and feed dashboards.

Detailed explanation

PDF p.321

Network Logs

  • Generated By: Routers, firewalls, switches, access points.
  • Content: Operation and status of the appliance, traffic, and access logs.
  • Examples of Threats
    • Switch Logs: Reveal endpoints using multiple MAC addresses for on-path attacks.
    • Firewall Logs: Identify scanning activity on blocked ports.
    • Access Point Logs: Record disassociation events indicating wireless network attacks.

Firewall Logs

  • Configuration: Any rule can generate an event when triggered.
  • Usage: Typically used for testing new rules or high-impact rules.
  • Audit Event Details: Date/timestamp, interface, traffic direction (ingress/egress), packet status (accepted/dropped), source/destination address, and port numbers.
  • Investigation Support: Confirms connection attempts and identifies rules needing adjustment.

IPS/IDS Logs

  • Event Generation: When traffic patterns match a rule.
  • Volume: High volume of events, log high sensitivity/impact rules.
  • Additional Logs: Shuns, resets, redirects (similar to firewall).
  • Visualization: Summary event data in dashboard graphs to represent threat levels.
  • Analysis: Helps attribute intrusion events to specific actors and develop threat intelligence.

Important terms

taken from the text above
Generated By
Routers, firewalls, switches, access points.
Switch Logs
Reveal endpoints using multiple MAC addresses for on-path attacks.
Firewall Logs
Identify scanning activity on blocked ports.
Access Point Logs
Record disassociation events indicating wireless network attacks.
Audit Event Details
Date/timestamp, interface, traffic direction (ingress/egress), packet status (accepted/dropped), source/destination address, and port numbers.
Investigation Support
Confirms connection attempts and identifies rules needing adjustment.
Event Generation
When traffic patterns match a rule.
Volume
High volume of events, log high sensitivity/impact rules.
Additional Logs
Shuns, resets, redirects (similar to firewall).
Visualization
Summary event data in dashboard graphs to represent threat levels.
Analysis
Helps attribute intrusion events to specific actors and develop threat intelligence.

Examples & real-world scenarios

Supplementary — not from your PDF
  • Firewall logs showing repeated blocked attempts across many ports from one IP.
  • An AP logging mass disassociation events.
  • IPS logs showing shunned sources.

Scenario

Firewall logs show one external IP trying hundreds of ports in a minute, all dropped. That's evidence of scanning. The team confirms nothing was allowed and adds the IP to a watch list.

Common mistakes

Supplementary — not from your PDF
  • Logging every firewall rule, drowning analysts in data.
  • Ignoring access point logs when investigating wireless issues.

Practical skills

Supplementary — not from your PDF
  • Read a firewall log entry and describe what happened.

What I should remember

Key Points PDF p.321
  • Network Logs
    • Generated By: Routers, firewalls, switches, access points.
    • Content: Appliance operation, traffic, access logs.
    • Examples: On-path attacks, scanning activity, wireless network attacks.
  • Firewall Logs
    • Configuration: Event generation by rule.
    • Usage: Testing new/high-impact rules.
    • Details: Date/timestamp, interface, traffic direction, packet status, addresses, ports.
    • Support: Confirms connections, adjusts rules.
  • IPS/IDS Logs
    • Event Generation: Traffic pattern matches.
    • Volume: High, log high sensitivity/impact rules.
    • Additional Logs: Shuns, resets, redirects.
    • Visualization: Dashboard graphs for threat levels.
    • Analysis: Attribution and threat intelligence.