Intrusion event occurs on the network it needs to be analyzed to determine the who what where and when
things happen.
Network intrusion analysis primarily uses information like IP addresses and port numbers to track security
events.
Here's a list of some of the common types of information that we are looking for while analyzing network
intrusions.
Here's the intrusion analysis page used by Cisco's firepower Management Center.
As you can see there is detailed information for each intrusion event.
Let's click on one to take a closer look and see what type of security event artifacts can be found.
So here on the detailed and network intrusion analysis page I can see when events occurred.
The source and destination hosts that were involved in the event as well as later for port numbers and
application protocols collectively these common security artifacts can be used to analyze intrusion
events
intrusion devices also have the ability to analyze more than just data payloads such as protocol hatters
protocol headers are used to carry network model layer protocols like IP TCAP and HTP preprocessors
that analyze header information can detect attacks that exploit things like IP fragmentation check some
validation and TZP or UDP sessions and the next video we will analyze an intrusion event with a recap
file and drill into protocol matters.
And some of the other common security artifacts.