- [Instructor] There are many, many
security monitoring tools, right?
So this includes a traditional
and next generation intrusion detection
and prevention systems, anomaly detection to
look for frequent large or lengthy network sessions,
and many more, right?
In the security operation center
you actually have to combine this type of tools
and also use threat intelligence recorder.
So combine the telemetry information.
Gather from IPS, firewall, server logs and everything
but correlate them with threat intelligence, right?
And threat intelligence are used for
event research and analysis, right?
So these threat intelligence can be imported
into alerting tools to add detection and fidelity, right?
Also deploy malware analysis tools to detect
and block malware and zero-day exploits, right?
As you learn in lesson 10,
you can deploy full packet capture to see
everything that is happening in your network.
However, this requires large amounts of storage space
but can be very useful for forensics, right?
You can deploy things like NetFlow, Bro, Tshark
and other tools to actually obtain packet metadata
instead of full packet capture.
And this actually is done since it doesn't require
as much storage space as full packet captures of course.
Cisco offers a managed security service where
customers outsource their
security operations center activities to Cisco.
The service is actually called the Active Threat Analytics
or ATA.
I'm including the high level overview
of the architecture of that service.
So you can actually get an idea of the tools involved
in the security operations center, right?
And what are the tools that actually,
at least some of the tools that Cisco uses
for that service and in the security operations centers
that they have around the world, right?
Cisco created an open source
big data security and analytics framework called OpenSOC,
or the Open Security Operations Center.
It was actually designed to consume and monitor
network traffic from their customers, right?
And specifically in large environments, right?
Because it's very scalable.
Now OpenSOC was then evolved into Apache Metron.
And Apache Metron is a framework that allows you to
consume process and analyze telemetry for
many, many different vendors and different products, right?
I'm including a link to Metron's website
and their GitHub repository here for your reference.