CHAPTER 12Intrusion Data Analysis
Upon completion of this chapter, you will be able to answer the following questions:
What is the structure of alerts?
How are alerts classified?
How is data prepared for use in a network security monitoring (NSM) system?
How do you use Security Onion tools to investigate network security events?
Which network monitoring tools enhance workflow management?
What is the role of the digital forensic processes?
This chapter uses the following key terms. You can find the definitions in the Glossary.