- Whenever you were preparing for the SecOps exam,
you know, you learned that there are
many different security technologies and products
that can be used in the security operations center
or the SOC, right?
And many organizations actually use these type of products,
of course, to not only protect the organization
but also to monitor their network traffic.
And it is really important to understand
what products and technologies are actually used
for what type of security event types, right?
And how to analyze these events.
So let's start with intrusion detection
and prevention, right?
So here I'm actually showing
the different types of analysis
and features provided by intrusion detection
and prevention systems and example products, right?
So here, I'm actually showing the different type of analysis
and features provided by anomaly detection and systems
and example products as well, right?
So again, you know, there's different types of devices
for intrusion prevention and different type of devices
and solutions for abnormal detection as well
that are very useful in the SOC, right?
Now, here, I'm actually showing
the different type of analysis and features
provided by malware analysis technologies
and example products like, you know
the Cisco AMP and, you know, others as well, right?
Now, you also in the SOC may have to do full packet capture.
And, you know, of course, for the purpose of
forensics and further analysis,
I'm able to actually do that type of, you know, collection
of the full packet captures,
just like we actually cover in the previous lessons, right?
So here I'm actually showing the different types of analysis
and features provided by full packet capture solutions
and also example products as well, right?
Here, I'm actually showing the different types of analysis
and features provided by protocol
and packet meta-data solutions, right?
So one of the drawbacks from a full packet captures
is, of course, the need of a lot of storage and, you know,
processing power to actually, you know,
not only store but also analyze,
you know, the full pocket captures.
So one of the things that actually many organizations
actually take advantage of is to do
protocol and packet meta-data analysis, right?
So here I'm actually showing the different type of analysis
and features provided by protocol and packet meta-data
solutions and also example products.
Now, depending on the technology and products used,
you may need to analyze
thousands upon thousands of logs and events, right?
So, tools that provides capabilities
to see the overall health of your network
but also allows you to actually do a deep dive
on the details about each of the security events
and potential intrusions, you know, assist.
And one of the tools actually is
the Cisco Firepower Management Center, right?
So the FMC, it actually has drilled down views
and table views of events
that share some common characteristics
that you can actually use to narrow a list of events
and then concentrate your analysis
on a group of related events
as I'm actually showing here, right?
You can see two different type of messages
related to SNMP in this case, right?
And the count of times such event
was actually encountering the network, right?
You know, to access the type of intrusion event
of workflow in the FMC,
you can actually navigate to analysis, intrusion,
and then events, right?
Now you can optionally limit the number of intrusion events
that actually appear on the event views
as described in the intrusion events drilled on page
or the intrusion events table view constraints, right?
You know, of course here you can actually see
all the different events that match the first message type
or the threat shown before.
You know, that we actually show before.
Here, you can actually see a detailed information
about the source and destination, IP addresses,
geolocation information, source and destination ports,
and many other types of information, right?
So, and other, you know, good things
that you can actually click on each of the items in the FMC
and either download the packets to your local system
or actually view the packet's details
as I'm actually showing in here, right?
So again, you know there are many tools out there
for this type of analysis
and different tools that can be used in the SOC.
We summarize, you know, some of these tools in here
and also we reviewed some of the examples of those tools
including the Cisco Firepower Management Console.
And there are many, many different options in the Cisco FMC
and you know, these tools that will actually
help you prioritize, classify, and analyze,
you know, event information and packet details
within your organization to, of course,
identify an attack, identify a threat actor,
and remediate that intrusion within your organization.