4Network Intrusion Analysis

• 4.1Mapping security events to their sources

  Builds the skill of instantly judging which sensor produced a given alert or log—an IDS/IPS, a firewall, a NAC, a proxy, an antivirus, or NetFlow—from the shape of the event (signature ID, allow/deny, authentication/posture, URL category, sample name, flow statistics), as the starting point for SOC correlation.

• 4.2Judging alert impact (true/false positives and negatives)

  Builds the skill of matching whether an alert fired against whether malicious activity actually occurred, to classify it as a true positive (TP), false positive (FP), true negative (TN), false negative (FN), or benign (legitimate yet matching a signature), as the foundation for triage prioritization and detection tuning. It also fixes the operational weight that an FN is the most dangerous and an FP drives alert fatigue.

• 4.3Comparing inspection methods and sensor placement

  Covers the differences in inspection depth among packet filtering (stateless), stateful inspection, and deep packet inspection (DPI), plus inline vs. tap/SPAN (can it block, does it affect the live path) and full packet capture (tap) vs. transactional (NetFlow) (does it carry payload, can it be retained cheaply for the long term), framed as the design judgment of "which method fits this goal."

• 4.4PCAP analysis (stream reassembly and elements of an intrusion)

  Covers the procedure of reassembling a TCP stream from a captured pcap to extract transferred files (Wireshark's Follow TCP Stream or Export Objects), and the elements of an intrusion read from packet data—source/destination address, source/destination port, protocol (the 5-tuple) plus payload—as the hands-on SOC work of identifying the victim host and the C2/exfiltration destination.

• 4.5Protocol headers, artifacts, and regular expressions

  Covers what each header element of Ethernet/IPv4/IPv6/TCP/UDP/ICMP/DNS/SMTP, POP3, IMAP/HTTP, HTTPS/ARP reveals, the artifacts (IOCs—hashes, URLs, domains, IPs, filenames, etc.) that are the products of analysis, and basic regular expressions as the tool for searching logs/payloads, as the skill of surfacing threats and feeding the next stage of investigation.