>> Hello, and welcome to the second lesson
>> of the first module, Data Collection.
>> This video is about internal data acquisition.
This video is fully dedicated to explain
the different categories of internal data sources.
Before thinking of gathering data or information
>> from external sources,
>> it is wise to think about getting
>> the most out of your available row crystals,
>> or should I say, your IT environment
or IT infrastructure.
There are literally hundreds of possible
>> types of data sources around your environment.
>> By leveraging threat data from your own network,
you can detect and stop threats.
In these cases, you need to know that understanding
all the log types and sources
available for selection can be pretty difficult.
There is no way we could ever think
>> to cover every possible source of logs.
>> This is why we need to identify
>> what may be more valuable than others as a start point.
>> We can always add more sources as we go.
Let's start with defining
what data are we collecting internally.
Internal data sources in globe,
any data that could be collected
>> within the organization.
>> It can be host or endpoint data,
network data, or even finished intelligence.
Keep in mind that in most of the cases,
threat intelligence analysts
>> are not responsible for data collection.
>> But they need to be knowledgeable about the data
>> they would request from other teams
>> in order to build contexts,
especially in case of incident.
Let's start with a host data.
Host data comes from endpoint devices.
We can call it also endpoint data.
These devices can be mobile phones, laptops,
desktop PCs, but also may cover hardware
>> such as servers, like in data centers.
>> You'll be interested in collecting
the following data within your endpoints.
Process execution metadata,
this data will contain information,
all the different processes running on your endpoints.
Registry access data,
this data will be related to registry objects,
including keys and value metadata on Windows
>> based endpoints of course.
>> File data, this data includes
dates when the files of the hosts
>> were created or modified,
>> as well as their size, type, and location
>> where they are stored within the disc.
>> Finally, network data.
This data will define
the parent process for network connections.
Here data could be collected through ADR,
IDS, Sim sensors,
>> but also through forensic tools.
>> Now let's move to the second type
of internal data sources.
Network data.
It involves collecting data from network
>> and security devices available in your environment.
>> Here I collected some sources
>> that you might find in your IT infrastructure.
>> Starting with a firewall,
this data is one of the most important data
>> that you will be collecting.
>> Firewall logs will contain information
on network traffic at the border of the network.
Proxy logs, here you will be collecting
HTTP data containing information
on outgoing web requests,
such as Internet resources that are
being accessed within the internal network.
[inaudible] logs, the logs you will get here will contain data
>> related to domain name server resolution.
>> These will include domain to IP address mapping.
Web server logs,
they recalled all user requests
that were processed by the server,
including information about the users.
These logs also include other errors.
We can find also authentication server logs.
They include sign-in failures,
successful logins, and valid request, etc.
You can ingest all of these logs into some solution
>> and create specific rules for detection.
>> Speaking of this, if you are interested
>> in learning more about Sims,
>> I highly recommend visiting
the different courses and labs
about same tools and products
>> that are already available on Cybrary.
>> Threat intelligence data is
the third type of internal data sources.
Threat intelligence data comes
from working on investigations.
You can leverage intelligence from your own network,
especially when you are working on a campaign analysis.
In many cases, your own network
shows more relevant intelligence to
organization than the intelligence
that you are collecting from external data sources.
Maintaining a historical knowledge
>> of best investigation is helpful
>> in leveraging more mature threat awareness
>> based on internal sources,
including indicators of compromise,
storage in your threat intelligence platform.
Vulnerability scan reports, malware
analysis reports, forensic reports,
incident response reports
and threat intelligence reports,
including the related indicators,
malware, and if no the attribution
and motivation of adversity.
That's all for this lesson.
Here we discuss the different types
of internal data sources,
starting with host data sources,
network data source,
>> and threat intelligence data source.
>> In the next video,
we will move to the second type of data collection,
the external data sources.
>> See you there.