27.1 A Common Data Platform 27.1.1 ELKĪ typical network has a multitude of different logs to keep track of and most of those logs are in different formats. Enhancing the Work of the CyberSecurity Analyst Describe network monitoring tools that enhance workflow management. Investigating Network Data Use Security Onion tools to investigate network security events. Topic Title Topic Objective A Common Data Platform Explain how data is prepared for use in a Network Security Monitoring (NSM) system.

Module Objective: Interpret data to determine the source of an alert. Module Title: Working with Network Security Data In this module, you will learn about network security data and some of the tools that are used to investigate it. Specialized tools are required to process, search, and investigate this data. There are many different types of data that are used in network security monitoring.

27.4.1 What Did I Learn in this Module?Ģ7.0 Introduction 27.0.1 Why Should I Take this Module?.

27.4 Working with Network Security Data Summary.

Selecting Visualizations for a Custom Kibana Dashboard.

27.3 Enhancing the Work of the Cybersecurity Analyst.

27.2.16 Lab – Investigating an Attack on a Windows Host.

27.2.15 Lab – Investigate a Malware Exploit.

27.2.14 Lab – Isolate Compromised Host Using 5-Tuple.

27.2.13 Video – Isolate Compromised Host Using 5-Tuple.

27.2.12 Lab – Interpret HTTP and DNS Data to Isolate Threat Actor.

27.2.11 Video – Interpret HTTP and DNS Data to Isolate Threat Actor.27.2.10 Lab – Extract an Executable from a PCAP.27.2.9 Lab – Regular Expression Tutorial.File Details from Zeek as Displayed in Kibana.27.2.7 Investigating Process or API Calls.27.1.5 Lab – Convert Data into a Universal Format.Kibana Management Frame Showing Logstash Index Details.27.0.2 What Will I Learn in this Module?.

Wireshark command line security onion