CHAPTER 12Intrusion Data Analysis


Upon completion of this chapter, you will be able to answer the following questions:

  • What is the structure of alerts?

  • How are alerts classified?

  • How is data prepared for use in a network security monitoring (NSM) system?

  • How do you use Security Onion tools to investigate network security events?

  • Which network monitoring tools enhance workflow management?

  • What is the role of the digital forensic processes?

Key Terms

This chapter uses the following key terms. You can find the definitions in the Glossary.

CapME page 543

OSSEC page 544

Suricata page 544

ELSA page 544

true positive page 551

false positive page 551

true negative page 552

false negative page 552

deterministic analysis page 553

probabilistic ...

Get CCNA Cybersecurity Operations Companion Guide, First Edition now with O’Reilly online learning.

O’Reilly members experience live online training, plus books, videos, and digital content from 200+ publishers.