★ Starred in your notes: honeynet · $ENV / hidden folders · SID -500 admin / -501 guest · (Day 5) SIEM vs. syslog · syslog level 7 = debug.
Breakdown 1 — What to monitor
Systems (OS logs, resource use, authentication), applications (app logs, errors, transactions), infrastructure (firewalls, switches, IDS, cloud control plane, physical sensors). Monitoring is the detective layer that catches what preventive controls miss.
Breakdown 2 — Activities
| Activity | Meaning |
|---|---|
| Log aggregation | Collect logs centrally (syslog → SIEM) so an attacker wiping a host doesn't erase evidence, and events can be correlated |
| Alerting | Rules/correlations trigger notifications |
| Scanning | Vulnerability/config scans feed the picture |
| Reporting | Dashboards, compliance reports, trends |
| Archiving | Retain logs per policy (and for forensics/legal hold) |
| Alert response & remediation/validation | Quarantine (isolate the host/file) and alert tuning (reduce false positives so real alerts aren't buried — "alert fatigue") |
Breakdown 3 — Tools
| Tool | What it does | Class notes |
|---|---|---|
| SCAP | Security Content Automation Protocol — standard formats (CVE, CVSS, OVAL, XCCDF) so tools can check configs/vulns automatically | |
| Benchmarks | Reference configs (CIS Benchmarks, DISA STIGs) to measure hosts against | "baseline review" |
| Agents / agentless | Agent = software on the host (rich, continuous data); agentless = remote polling (SNMP/WMI/SSH, nothing to install) | Class: "agent → think Puppet; agentless → think Ansible (central component)" |
| SIEM | Aggregates, correlates, alerts, reports across all log sources; the SOC's main console | Class functions: aggregation, correlation, alerts, log retention, analysis tools; vs. syslog — syslog only collects; SIEM shows "almost real time" |
| Antivirus / EDR | Signature + behavior detection on endpoints; EDR adds investigation/response | |
| DLP | Detects/blocks sensitive data leaving (email, web, USB) | "e.g., blocking social media" |
| SNMP traps | Devices push alerts (link down, high temp) to a manager; use SNMPv3 (auth + encryption) | Class: components = agent (on the device), manager (collector), OID (object identifier), MIB (management information base); community strings public/private are the v1/v2c "passwords" (cleartext) — v3 adds strong authentication and encryption. SNMP enumeration = attackers reading device details through weak community strings |
| NetFlow | Metadata about traffic flows (who talked to whom, how much) — spot exfiltration, C2 beacons, DDoS | |
| Vulnerability scanners | Nessus, OpenVAS | |
| FIM (class) | File integrity monitoring — check the file's hash against a known-good value; alerts on changes to system files/configs | |
| IDS/IPS | Signature, heuristic/anomaly, stateful protocol analysis | see 3.2 — class: IPS → active IDS; IDS → just detects |
| Packet capture (class) | Packet sniffers capture, packet analyzers decode (Wireshark); fed by SPAN/port mirror, a TAP (terminal access point, passive hardware), or a network packet broker (NPB) | Inline vs. tap-based monitoring; a MAC flood makes a switch behave like a hub so an attacker can sniff |
| Physical sensors (class) | Temperature, humidity, door, motion, water | Data-center environmental monitoring |
| User behavior analytics (class) | e.g., Splunk UBA — baseline per user, flag anomalies | Insider threat, compromised accounts |
| DNS sinkhole (class) | Resolve known-bad domains to a harmless IP → blocks C2 and reveals infected hosts | |
| Content filtering (class) | Redirect/block based on categories/tags | |
| Deception (class) | Honeypot (decoy system), honeynet (network of honeypots), honeytoken (decoy account/data), honeyfile (fake file with "passwords") | see 1.2 |
From class — host indicators to know:
$ENV/%ENV%variables and hidden folders; Windows SID (security identifier — ends in -500 = built-in Administrator, -501 = Guest). VirusTotal for checking a file hash.
Breakdown 4 — Scenario matching
| Scenario | Tool/activity |
|---|---|
| Correlate a failed VPN login with a firewall block and an EDR alert | SIEM |
| Detect a system binary silently replaced | FIM |
| See which internal host is sending 5 GB to an unknown IP at 3 a.m. | NetFlow |
| Switch port went down — notify NOC immediately | SNMP trap |
| Analysts ignore alerts because 95% are noise | Alert tuning |
| Infected host keeps trying to reach a malware domain | DNS sinkhole (and quarantine) |
| Verify 300 servers match the CIS baseline automatically | SCAP + benchmarks |
| Can't install software on an appliance but need to monitor it | Agentless |
Quick self-check
- Agent vs. agentless trade-off? (Depth vs. footprint.)
- What does NetFlow capture — payload or metadata? (Metadata.)
- What's the purpose of alert tuning? (Cut false positives / alert fatigue.)
Sources: 20260917_173423.jpg, 20260917_173429.jpg, 20260917_182520.jpg, 20260918_175512.jpg, 20260918_175519.jpg, 20260918_175529.jpg