To be able to quickly investigate security events it is important to know where to start with so many
source technologies that can be used to obtain event data.
It can be overwhelming.
In this video we are going to break down which source technologies should be used for each event type
anomaly detection can be one of the most difficult events to detect dramatic changes in network behaviors
need to be correlated to confirm these events.
Not flow data is a perfect feed of the type of information needed to accomplish this.
For example if not all data is used to monitor data usage to a web server then you'd be able to identify
spikes in traffic to the server.
If HTP traffic between the internal network and the web server is at a average of 50 megabits per second.
But then one day shows that it's hitting 200 megabits per second than that enough little data could
trigger an anomaly detection event.
Choosing events as you probably guessed to are detected by ID as an IP GPS devices any packets traversing
the network that match intrusion signatures will be visible in the ID ass or IP as Event Logs firewall
events such as denial of service attacks sin floods and port scans can be discovered from firewall logs
network application control also referred to as AVC can detect malicious application proxy logs can
be used for identifying malicious Web site activity and finally anti-virus can be used to detect suspicious
program activity.