- [Instructor] One of the common tasks
in the Security Operations Center
is for you to identify potential data loss
from a specific traffic profiles
and a specific things and observables
that you may obtain from the network.
In my case, I'm actually sharing the StealthWatch dashboard
and you see that there is a specific source
the 10.201.3.149,
which basically is being highlighted
a few times of a potential data loss
for a potential data loss incident.
So you see that there's some data that is being sent
but the maximum amount of bytes is 10 megs.
And you see a few other entries.
One specifically highlights the user Ken, as you see.
And if you click on the details,
it will actually take you to this page
where you see the security event
for that a specific transaction.
So again, you'll see the source,
the 10.201.3.149.
And it says that security events is suspected data loss.
And it's because it's an indication
that that host has uploaded an abnormal amount of data
outside of the host.
Now again, this is just one example
out of many that you can detect,
potential ex-filtration of traffic
and sensitive information.
There are other capabilities
that help you detect the payloads of packets
to see if there's potentially credit card information,
personal identifiable information, and so on.
This is just one example,
but it's one of the biggest tasks that you have
in the Security Operations Center
is to identify potential data loss
from different traffic profiles
and different traffic patterns.