Investigating Network Flows and Security Solutions Alerts

In most digital networks, there are network devices such as routers that generate flows and security solutions that generate security alerts. That information and data are useful to detect and investigate various cyber threats. As an SOC analyst, you should be aware and take advantage of the flow metadata provided by network devices such as routers and layer 3 switches, and the alerts generated by security solutions such as Antivirus (AV), Endpoint Detection and Response (EDR), an Intrusion Prevention System (IPS), an Intrusion Detection System (IDS), a network sandbox, and a network AV.

The objective of this chapter is to learn how to detect and investigate cyber threats by utilizing the flow metadata provided by network devices such as routers and layer 3 switches, and the alerts generated by security solutions such as AV, EDR, IPS, IDS, a network sandbox, and a network AV.

In this chapter, we’ll cover the following...

Investigating network flows

The flow, also commonly known as NetFlow, is network session information generated by network devices, such as routers and layer 3 switches, to aid network engineers during network issue troubleshooting. The flows have several names, based on the device vendor – for example, the used protocol for Cisco devices’ flow control is NetFlow (which is the most common and well-known flow protocol), Jupiter devices’ flow protocol is J-Flow, and HP devices’ flow protocol is Netstream.

Regardless of the name of the protocol used to generate the network session information, the generated information includes at least the following details:

• Timestamps (start and finish)
• A source IP
• A destination IP
• A source port
• A destination port
• Transferred bytes

Most SIEM solutions provide an integration capability to receive flows from different network devices. As an SOC analyst, you should take advantage of the network...

Investigating IPS/IDS alerts

The Intrusion Prevention System (IPS) is a security appliance that is deployed inline in a network to constantly watch the network traffic, preventing threats and any malicious attempts to exploit a known vulnerability (see Figure 13.1):

Figure 13.1 – An IPS layout

As you see in the preceding figure, the IPS is implemented inline for data communication, which allows it to monitor the network traffic between networks to prevent cyber threats.

The Intrusion Detection System (IDS) is a security appliance that is deployed out of band from data communication by using port mirroring, a SPAN port, or a network tap to capture network traffic, detecting threats, anomalies, and any malicious attempts to exploit a known vulnerability (see Figure 13.2):

Figure 13.2 – An IDS layout

As you can see in the preceding figure, the IDS is implemented out of band from data communication by using a...

Investigating endpoint security solutions alerts

Endpoint security solutions are security solutions that are implemented on an organization’s hosts to protect them against cyber threats such as malware infections, credential theft, and suspicious behavior. There are several types of endpoint security solutions; the most common and widely used types are AV and EDR solutions. In this section, we will learn how to investigate samples of the alerts received from both AVs and EDRs.

Investigating AV alerts

The AntiVirus (AV) is an endpoint security solution that is designed to detect and prevent different malware types such as Trojans, worms, and ransomware, based on a signature, which could be a file hash or malware code characters.

The alerts received from the AV solutions contain at least the following details:

• An infected machine name
• An infected filename
• An infected file path
• An infected file hash
• A malware name
• A malware category

While...

Investigating network sandbox and AV alerts

The network AV solution is a crucial network security control that organizations implement to scan all files and URLs that are either transferred internally or sourced from external resources, such as emails and web servers. This solution scans files and URLs against malware signatures and bad URLs database before transmitting them to end users.

The network sandbox solution is a network security solution implemented in an organization’s network to render or execute and analyze the behavior of files and URLs, including those internally transferred and downloaded from external resources such as email and a web server in an isolated environment, before sending them to an end user. Sandbox technology will be discussed in detail later in Chapter 15, Malware Sandboxing – Building a Malware Sandbox.

Both devices can be deployed either as a standalone device or come with another security control, such as a Next-Generation Firewall...

Summary

In this chapter, we discussed how to detect and investigate cyber threats by utilizing the flow metadata provided by network devices such as routers and layer 3 switches, and the alerts generated by security solutions such as AV, EDR, IPS, IDS, a network sandbox, and a network AV.

In the next chapter, we will learn about the threat intelligence platforms that should be used by SOC analysts to investigate cyber threats.