We utilize people, processes, and technical tools to implement the identification phase of the incident response process, which includes detection and analysis.
These types of tools allow the incident responder to have visibility into the network, allowing them to establish a baseline for what it normally looks like, and to easily visualize when anomalous behavior is occurring. Observational technical tools include:
- Host and network-based intrusion prevention and intrusion detection systems (IPS/IDS): These tools are put in place to perform real-time monitoring of your network and server/workstation activity. These tools are typically signature-based and look for suspicious activity that matches a preconfigured signature. If a condition matches a signature the tool will either block (IPS) or alert (IDS). The open source tool examples are as follows:
- Suricata: https://suricata-ids.org/
- OSSEC: https://ossec.github.io...
