2.1Attack surface and monitoring data technologies

A SOC (Security Operations Center) exists to find anomalies on the "surface an attacker can touch" amid endless traffic, and to decide the next move from the evidence. That starts with understanding the relationship between the total set of entry points an attacker can target—the attack surface—and the weaknesses within it—vulnerabilities—and then being able to choose which monitoring technology shows what at which granularity. This section organizes the data sources, from tcpdump that captures whole packets, to NetFlow that shows only summary statistics of a conversation, to the NGFW that identifies and controls applications, as the judgment of selecting a source by working backward from the visibility you need.

2.1.1Attack surface and vulnerabilities

• The attack surface is the total set of entry points where an attacker can attempt intrusion or abuse—open ports, web forms, APIs, email, remote access, and employees (people). The larger the surface, the more you must defend. A vulnerability, by contrast, is a concrete weakness on that surface (unpatched software, misconfiguration, weak authentication). In short, the attack surface is "where can be targeted" and a vulnerability is "how that spot is weak."
• For monitoring, mapping the attack surface decides where to place sensors (data sources). Put visibility where the surface concentrates—the boundary (the internet edge), the DMZ, server segments, and remote-access paths. Reducing the attack surface (closing unneeded ports, disabling unneeded services) lowers both the area to defend and the volume to monitor.

2.1.2What each monitoring technology reveals

• tcpdump is a packet-capture tool that records full packets, including the payload (the actual content). It can reconstruct the real data of an attack (the strings or files sent), but the data volume is very large and unsuitable for long retention. It is powerful for deep investigation, yet "everything, all the time" is impractical.
• NetFlow records summarized metadata / flow statistics of a conversation (source/destination IP, ports, protocol, byte and packet counts, timestamps). It cannot see content, but it lightweightly retains who talked to whom, when, and how much over long periods, and excels at spotting abnormal volumes or beaconing (regular-interval outbound traffic).
• An NGFW (next-generation firewall) controls by identifying not just ports/protocols but applications and users, integrating IPS and malware inspection. Relatedly, AVC (Application Visibility and Control) provides per-application visibility and control independent of port number (e.g., the various apps riding on port 443). A stateful firewall tracks the state (connection) and permits only return traffic of established connections—unlike a stateless one that inspects each packet in isolation.
• Web filtering controls web access by URL/category/reputation, blocking redirects to malicious sites and reachability to C2. Email filtering (content filtering) blocks phishing, malicious attachments, and spam before delivery. Both add visibility and control to the primary intrusion vectors (web and email).

You are a SOC analyst and receive an alert that "one internal PC may be talking to an unfamiliar external IP." What you want first is "what was actually sent (data theft, or C2 commands?)", but immediately deploying company-wide tcpdump is a hasty call—full packets are enormous, and evidence going back in time often was never retained. In real triage you first look at the lightweight, long-retained NetFlow. The flows show the PC sending small amounts of data to the same external IP on port 443 at almost exactly the same interval every hour. That is a classic beaconing (suspected C2) pattern, and because each transfer is small it never trips a naive "large upload = exfiltration" rule. NetFlow shows no content, yet the shape of the metadata—"regular outbound communication"—is a strong indicator of compromise. As the next move, you check whether that destination IP/URL is malicious via web filtering reputation, and if suspicion grows you narrow to that one flow and capture its content with tcpdump to confirm the command payload. The key judgment is that "the most detailed tool, tcpdump, is not always right." Each granularity (full packet / flow statistics / app identification) answers different questions well, and the analyst's skill is choosing the source by working backward from "do I need volume, the peer, or the content right now?" Do not relax just because it is port 443—if AVC or the NGFW can identify the actual app running on 443, you can notice a tunnel hidden behind encryption.

2.1.3Section summary

• The attack surface is the total set of entry points an attacker can target; a vulnerability is a concrete weakness there. Map the surface to decide where to place sensors
• tcpdump sees content but is heavy; NetFlow shows no content but retains lightweight metadata long-term. Choose by working backward from the question (volume/peer/content)
• An NGFW/AVC identifies apps/users, a stateful FW tracks connection state, and web/email filtering blocks the primary intrusion vectors