WEBVTT 0:00:03.900000 --> 0:00:07.360000 Introduction to Network Analysis and Incident Response. 0:00:07.360000 --> 0:00:12.220000 So welcome everyone to the Network Analysis section of this course. 0:00:12.220000 --> 0:00:15.980000 And to kick things off, we're going to be, as the title suggests, getting 0:00:15.980000 --> 0:00:19.800000 an introduction to Network Analysis and Incident Response. 0:00:19.800000 --> 0:00:23.640000 So we're going to take a look at what Network Analysis is, what it entails. 0:00:23.640000 --> 0:00:28.400000 And this will be, you know, will be taking a look at this specific to 0:00:28.400000 --> 0:00:30.080000 incident response. 0:00:30.080000 --> 0:00:35.820000 So let's get started by understanding firstly what Network Analysis is. 0:00:35.820000 --> 0:00:41.160000 So Network Analysis in Incident Response specifically is the process of 0:00:41.160000 --> 0:00:45.940000 examining network traffic and communications in order to detect, investigate 0:00:45.940000 --> 0:00:52.100000 or analyze and understand suspicious or malicious activity within an organization's 0:00:52.100000 --> 0:00:55.080000 environment or in this case, network, right? 0:00:55.080000 --> 0:00:59.140000 And it involves reviewing various forms of network data ranging from raw 0:00:59.140000 --> 0:01:05.660000 packets to high-level logs in order to trace the actions or activity of 0:01:05.660000 --> 0:01:10.360000 attackers, identify compromised systems and determine how an incident 0:01:10.360000 --> 0:01:15.680000 unfolded. So it's sort of the network, as the title suggests or as its 0:01:15.680000 --> 0:01:20.240000 name suggests, it's the Network Analysis aspect of analysis. 0:01:20.240000 --> 0:01:24.360000 So if they're going to look at Endpoint Analysis and now we're taking 0:01:24.360000 --> 0:01:29.960000 a look at Network Analysis and the reason for that is just like Endpoints, 0:01:29.960000 --> 0:01:36.020000 networks can also tell us a lot about, you know, an incident or can tell 0:01:36.020000 --> 0:01:40.060000 us a lot about what an attacker did, so on and so forth. 0:01:40.060000 --> 0:01:44.360000 So that's what Network Analysis is in the context of incident response. 0:01:44.360000 --> 0:01:48.960000 Now, that obviously leads to the question, what is the importance of network 0:01:48.960000 --> 0:01:51.480000 analysis in Incident Response? 0:01:51.480000 --> 0:01:56.860000 So in the detection and analysis phase of the Incident Response lifecycle, 0:01:56.860000 --> 0:02:02.920000 network analysis serves as a powerful tool or process to A, detect intrusions 0:02:02.920000 --> 0:02:07.840000 early, so identify signs of compromise such as unauthorized connections, 0:02:07.840000 --> 0:02:12.960000 malware communication or abnormal traffic patterns, B, validate alerts, 0:02:12.960000 --> 0:02:17.440000 so confirm whether alerts from intrusion detection or intrusion prevention 0:02:17.440000 --> 0:02:23.560000 systems, firewalls or SIEM systems are true positives, C, scope the incident, 0:02:23.560000 --> 0:02:28.200000 so determine which systems communicated with the attacker or which systems 0:02:28.200000 --> 0:02:33.400000 were involved in lateral movement or part of lateral movement of the attacker. 0:02:33.400000 --> 0:02:39.240000 D, understand attack attack tech, so reveal command and control, C2 channels, 0:02:39.240000 --> 0:02:45.900000 data exfiltration methods and privilege escalation attempts, and E, or 0:02:45.900000 --> 0:02:50.900000 lastly, support attribution and reporting, so it allows you to provide 0:02:50.900000 --> 0:02:55.700000 evidence that supports things like incident timelines, root cause analysis 0:02:55.700000 --> 0:02:58.440000 as well as incident documentation. 0:02:58.440000 --> 0:03:02.440000 So the best way to understand or to contextualize the importance of network 0:03:02.440000 --> 0:03:06.540000 analysis in Incident Response is to, again, think of network analysis 0:03:06.540000 --> 0:03:12.520000 as the black box recorder that you typically have in aircraft, but in 0:03:12.520000 --> 0:03:17.740000 this case, it's the black box recorder of a network environment or, you 0:03:17.740000 --> 0:03:24.020000 know, an IT environment as a whole, but specifically think of network 0:03:24.020000 --> 0:03:28.240000 analysis as the black box recorder of an incident, so it often holds the 0:03:28.240000 --> 0:03:32.400000 most objective record of what happened over the wire, and that's the key. 0:03:32.400000 --> 0:03:36.380000 So when you're dealing with what happened on a system, you then have endpoint 0:03:36.380000 --> 0:03:37.440000 analysis, right? 0:03:37.440000 --> 0:03:41.840000 But when you're dealing with, you know, connections into or onto a system, 0:03:41.840000 --> 0:03:46.840000 like authentication, stuff like the lateral movement is another good example, 0:03:46.840000 --> 0:03:49.320000 then you'd need to perform network analysis. 0:03:49.320000 --> 0:03:53.320000 So it's not that endpoint analysis is more important than network analysis, 0:03:53.320000 --> 0:03:58.580000 it just means that you're dealing with analyzing different types of activity 0:03:58.580000 --> 0:04:04.040000 on, you know, in the case of endpoint analysis, you know, you're analyzing 0:04:04.040000 --> 0:04:08.220000 endpoints, and when you're dealing with network analysis, you're dealing 0:04:08.220000 --> 0:04:10.700000 with what happened over the wire. 0:04:10.700000 --> 0:04:15.000000 So that brings us now to the types of network data sources. 0:04:15.000000 --> 0:04:19.320000 Now we went through this in the earlier section of this course when we 0:04:19.320000 --> 0:04:23.180000 were taking a look at logging, but now we need to be a bit more specific 0:04:23.180000 --> 0:04:30.620000 when we are describing or when we want to understand, you know, what what 0:04:30.620000 --> 0:04:35.320000 are the different or what types of data network data sources exist, and 0:04:35.320000 --> 0:04:40.460000 more importantly, how can they be analyzed? 0:04:40.460000 --> 0:04:44.580000 So different types of network data provide varying levels of detail and 0:04:44.580000 --> 0:04:49.180000 insight, and this is very important because again, a PCAP will tell you 0:04:49.180000 --> 0:04:53.680000 one thing or contains a certain amount of information as well as contextual 0:04:53.680000 --> 0:04:59.260000 information, but flow data will have, you know, different type of data, 0:04:59.260000 --> 0:05:04.560000 still the same, generally speaking, but, you know, different data, different 0:05:04.560000 --> 0:05:08.060000 types of network data sources will have different type or a different 0:05:08.060000 --> 0:05:10.880000 type and a different amount of information. 0:05:10.880000 --> 0:05:15.000000 So starting off with packet captures or PCAPs as they're known, these 0:05:15.000000 --> 0:05:21.320000 contain typically raw full content network traffic, and they allow for 0:05:21.320000 --> 0:05:23.700000 reconstruction of entire sessions. 0:05:23.700000 --> 0:05:27.860000 So think of emails, file transfers will actually get, you know, take a 0:05:27.860000 --> 0:05:31.960000 look, a practical look at what this is like with a tool like Wireshark, 0:05:31.960000 --> 0:05:37.100000 and then they also have high fidelity, but storage intensive because the 0:05:37.100000 --> 0:05:41.920000 PCAP files can be quite large depending on how much traffic is being captured. 0:05:41.920000 --> 0:05:48.180000 You then have flow data, so think of NetFlow, SFlow, or IP fix or IPFIX. 0:05:48.180000 --> 0:05:52.000000 So, you know, this contains metadata about communications. 0:05:52.000000 --> 0:05:56.000000 So think about IPs, ports, protocols, byte counts, etc. 0:05:56.000000 --> 0:06:00.480000 And these are great for identifying large data transfers, scanning or 0:06:00.480000 --> 0:06:04.980000 beakening. So think of network scans, exfiltration, stuff like this in 0:06:04.980000 --> 0:06:09.920000 terms of, you know, what you can use flow data to identify. 0:06:09.920000 --> 0:06:15.160000 And then sort of a final point or takeaway with regards to flow data is 0:06:15.160000 --> 0:06:20.340000 that it's low fidelity, but very scalable and as a result, less storage 0:06:20.340000 --> 0:06:26.760000 heavy or takes a less amount of space as compared to PCAPs or packet captures. 0:06:26.760000 --> 0:06:28.740000 You then have protocol metadata. 0:06:28.740000 --> 0:06:33.060000 So, you know, a very good way of understanding what I'm referring to here 0:06:33.060000 --> 0:06:37.960000 is Z-clogs. Now, you don't need to know what Z-K is at this point in time, 0:06:37.960000 --> 0:06:40.180000 but just think of layer seven insights. 0:06:40.180000 --> 0:06:43.120000 So if you know about the OSI model, then you know what layer seven is 0:06:43.120000 --> 0:06:45.500000 all about and the protocols that apply. 0:06:45.500000 --> 0:06:51.100000 So DNS queries, HTTP requests, TLS handshakes, all that good stuff. 0:06:51.100000 --> 0:06:55.660000 And it's very useful in helping you to identify misuse of legitimate services. 0:06:55.660000 --> 0:06:58.060000 For example, DNS tunneling. 0:06:58.060000 --> 0:07:02.920000 That's something that a lot of attackers do when it comes down to the 0:07:02.920000 --> 0:07:08.140000 facilitation or when they're trying to set up covert C2 communication 0:07:08.140000 --> 0:07:14.140000 channels. And we then have network logs. 0:07:14.140000 --> 0:07:16.880000 So here you can think of IDS, IPS alerts. 0:07:16.880000 --> 0:07:22.600000 So examples would be Surikata or SNOT, firewall logs, web proxy logs. 0:07:22.600000 --> 0:07:25.920000 And they generally speaking provide context around blocked or allowed 0:07:25.920000 --> 0:07:28.820000 traffic or, you know, rule matches. 0:07:28.820000 --> 0:07:31.760000 You then have name resolution and authentication logs. 0:07:31.760000 --> 0:07:36.460000 So, you know, DNS, DHCP and Kerberos logs provide asset identification 0:07:36.460000 --> 0:07:42.360000 and movement traffic, not traffic tracking, pardon me. 0:07:42.360000 --> 0:07:46.320000 So those are the types of network data sources. 0:07:46.320000 --> 0:07:50.480000 So, you know, where you'll be getting your network data from or your network 0:07:50.480000 --> 0:07:54.900000 evidence from and the type of information that is contained there in. 0:07:54.900000 --> 0:07:59.840000 And, you know, what their value is with regards to incident response or 0:07:59.840000 --> 0:08:00.940000 network analysis. 0:08:00.940000 --> 0:08:05.400000 So now we need to take a look at what are the explicit goals of network 0:08:05.400000 --> 0:08:07.560000 analysis in incident response. 0:08:07.560000 --> 0:08:11.040000 So why would you perform network analysis? 0:08:11.040000 --> 0:08:14.720000 Now, there's many reasons, but I've sort of aggregated them here in a 0:08:14.720000 --> 0:08:18.200000 way that makes sense to you based on what we've already covered. 0:08:18.200000 --> 0:08:23.060000 So, incident responders use network analysis to identify indicators of 0:08:23.060000 --> 0:08:28.920000 compromise. So, IPs, domains, protocol anomalies, signatures, etc. 0:08:28.920000 --> 0:08:33.920000 To detect malicious behavior patterns in the form of beaconing, C2 beaconing, 0:08:33.920000 --> 0:08:37.820000 network scanning, lateral movement, protocol tunneling. 0:08:37.820000 --> 0:08:42.100000 So, DNS tunneling is an example as well as exfiltration, which I mentioned. 0:08:42.100000 --> 0:08:47.160000 You also have, you know, you can also utilize network analysis to correlate 0:08:47.160000 --> 0:08:48.720000 events across time and systems. 0:08:48.720000 --> 0:08:52.760000 That's the most obvious use case based on what you already know about 0:08:52.760000 --> 0:08:58.020000 correlation. You're taking endpoint logs and network logs and you're correlating 0:08:58.020000 --> 0:08:59.540000 activity, right? 0:08:59.540000 --> 0:09:03.720000 So this allows you to build timelines, connect initial access to subsequent 0:09:03.720000 --> 0:09:05.820000 actions, so on and so forth. 0:09:05.820000 --> 0:09:11.400000 And also tie in activities that you would not be able to necessarily be 0:09:11.400000 --> 0:09:14.900000 able to get from endpoint or log analysis. 0:09:14.900000 --> 0:09:19.120000 For example, network scanning, that would be in the early stages of an 0:09:19.120000 --> 0:09:20.980000 attack, generally speaking. 0:09:20.980000 --> 0:09:25.040000 But that's something that you can only get from network analysis, right? 0:09:25.040000 --> 0:09:29.420000 You also have, you know, it also allows you to assess incident impact. 0:09:29.420000 --> 0:09:34.100000 So, determine if sensitive data was accessed or exfiltrated and understand 0:09:34.100000 --> 0:09:37.500000 the scale and duration of attack activity. 0:09:37.500000 --> 0:09:42.200000 And you also have enhancing or enhancement of detection capabilities. 0:09:42.200000 --> 0:09:46.660000 So, what this means is that you can utilize insights from analysis to 0:09:46.660000 --> 0:09:50.900000 create new alerts or signatures for proactive defense. 0:09:50.900000 --> 0:09:54.840000 Okay, so now that you have an understanding of what network analysis is 0:09:54.840000 --> 0:10:01.000000 all about, what it entails, the various types of network data sources 0:10:01.000000 --> 0:10:06.960000 and, you know, what the objectives are of network analysis. 0:10:06.960000 --> 0:10:11.000000 We can turn our attention to just as we did with endpoint analysis, the 0:10:11.000000 --> 0:10:13.220000 network based analysis methodology. 0:10:13.220000 --> 0:10:17.040000 So, when performing network analysis, you may have asked yourself, is 0:10:17.040000 --> 0:10:20.900000 there a methodology or a structure to this or a process to this? 0:10:20.900000 --> 0:10:23.380000 Well, yes, and that's what I'm going to be outlining right now. 0:10:23.380000 --> 0:10:27.820000 Now, of course, this is very generalized and the type of network analysis 0:10:27.820000 --> 0:10:31.960000 you perform is going to be very nuanced or biased. 0:10:31.960000 --> 0:10:38.360000 Very nuanced, depending on the type of incident you're investigating, 0:10:38.360000 --> 0:10:43.580000 right? But you always start with, you know, preparation and baseline understanding. 0:10:43.580000 --> 0:10:50.260000 So, this is not really what you'd consider a methodological step that 0:10:50.260000 --> 0:10:53.740000 you take or begin with when, you know, are told to analyze a PCAP, for 0:10:53.740000 --> 0:10:59.280000 example, but it's this sort of lays the groundwork for your network analysis. 0:10:59.280000 --> 0:11:03.200000 And the reason why this is important is because network analysis is going 0:11:03.200000 --> 0:11:06.920000 to rely very heavily on your understanding of the organization that you're 0:11:06.920000 --> 0:11:11.960000 protecting or that, you know, you work as an incident responder for. 0:11:11.960000 --> 0:11:15.680000 So, understand a normal network behavior and topology, so you actually 0:11:15.680000 --> 0:11:18.660000 know what is normal and what is not. 0:11:18.660000 --> 0:11:22.540000 And short access to network monitoring tools, logs and packet captures 0:11:22.540000 --> 0:11:25.380000 and, you know, verify logging policies. 0:11:25.380000 --> 0:11:29.100000 For example, what traffic is captured, where logs are stored because this 0:11:29.100000 --> 0:11:30.380000 is very important. 0:11:30.380000 --> 0:11:33.480000 In the event that you want to analyze network traffic, you need to know 0:11:33.480000 --> 0:11:38.160000 where you can access PCAP, so the most recent PCAPs, right? 0:11:38.160000 --> 0:11:40.840000 But we then move on to alert triage and scoping. 0:11:40.840000 --> 0:11:46.280000 So, you start with an alert or an anomaly, so think of an example would 0:11:46.280000 --> 0:11:49.860000 be from an IDS or a SEAM or a user report. 0:11:49.860000 --> 0:11:54.700000 So, you know, the tier one analyst could have alerted you and told you, 0:11:54.700000 --> 0:11:57.040000 hey, you probably want to check this out. 0:11:57.040000 --> 0:12:00.060000 So, again, you identify the initial indicators. 0:12:00.060000 --> 0:12:04.800000 In the case of network analysis, these would be IP addresses, ports, protocols, 0:12:04.800000 --> 0:12:06.160000 timestamps, etc. 0:12:06.160000 --> 0:12:11.120000 And then you, again, just like endpoint analysis and triage, you scope 0:12:11.120000 --> 0:12:14.280000 the affected systems, users and network segments. 0:12:14.280000 --> 0:12:16.440000 And then you move on to data collection. 0:12:16.440000 --> 0:12:19.880000 So, this is the collection slash acquisition phase, just like endpoint 0:12:19.880000 --> 0:12:24.120000 analysis. So, you pull the relevant network artifacts that you require 0:12:24.120000 --> 0:12:25.700000 for your analysis. 0:12:25.700000 --> 0:12:29.500000 So, you have packet captures or PCAPs, you have flow records, so think 0:12:29.500000 --> 0:12:30.860000 of NetFlow, SFlow. 0:12:30.860000 --> 0:12:36.120000 You also have IDS, IPS alerts, and then DNS web proxy and firewall logs, 0:12:36.120000 --> 0:12:40.000000 if applicable. And the idea here is to time box the data, which means 0:12:40.000000 --> 0:12:43.220000 narrow collection around key timestamps. 0:12:43.220000 --> 0:12:45.300000 And then you have the analysis phase. 0:12:45.300000 --> 0:12:49.100000 So, this is traffic analysis or flow analysis, but starting off, you usually 0:12:49.100000 --> 0:12:52.840000 have traffic analysis, which is going to be the focus of this section 0:12:52.840000 --> 0:12:57.580000 in the course. We'll be exploring more advanced network-based analysis 0:12:57.580000 --> 0:12:59.860000 in other courses within this learning path. 0:12:59.860000 --> 0:13:03.620000 But for now, our focus is going to be on traffic analysis. 0:13:03.620000 --> 0:13:08.100000 So, you examine communications for unusual destinations, so geolocation 0:13:08.100000 --> 0:13:13.780000 or a threat intel match, abnormal ports or protocols, beakening or persistence 0:13:13.780000 --> 0:13:19.320000 patterns, large data transfers, which could be indicative of potential 0:13:19.320000 --> 0:13:23.880000 exfiltration. And the idea here is to reconstruct sessions to see full 0:13:23.880000 --> 0:13:28.020000 conversations or to better understand exactly what's going on on the network, 0:13:28.020000 --> 0:13:32.600000 right? You then have correlation and contextualization. 0:13:32.600000 --> 0:13:37.380000 So, this is where you cross-reference your findings with host-based logs. 0:13:37.380000 --> 0:13:40.520000 That's why we covered the host-based analysis first, not because it's 0:13:40.520000 --> 0:13:44.980000 more important, but it'll start to make sense why network analysis is 0:13:44.980000 --> 0:13:50.040000 also important. Threat intelligence feeds as well as user activity. 0:13:50.040000 --> 0:13:54.580000 So, you build a timeline of events to understand attack objectives and 0:13:54.580000 --> 0:13:59.420000 movements from one system to the other, and then endpoint analysis allows 0:13:59.420000 --> 0:14:03.580000 you to determine what they did on a specific system. 0:14:03.580000 --> 0:14:09.180000 Network analysis allows you to determine what system they moved to first, 0:14:09.180000 --> 0:14:13.860000 how they moved through a system, so lateral movement, and what they exfiltrated, 0:14:13.860000 --> 0:14:16.000000 how much they exfiltrated. 0:14:16.000000 --> 0:14:20.220000 And more importantly, I should have said what they exfiltrated, because 0:14:20.220000 --> 0:14:25.820000 when performing analysis, you should be able to determine exactly from 0:14:25.820000 --> 0:14:30.140000 what system they exfiltrated data from and how much. 0:14:30.140000 --> 0:14:32.840000 And then you have documentation and reporting. 0:14:32.840000 --> 0:14:36.580000 So, you document all findings with timestamps, evidence, and conclusions. 0:14:36.580000 --> 0:14:40.580000 And again, just like endpoint analysis, you provide impact assessments 0:14:40.580000 --> 0:14:47.500000 and recommendations, and you share findings with other teams or the other 0:14:47.500000 --> 0:14:52.580000 teams involved in your incident response team as a whole, for example, 0:14:52.580000 --> 0:14:55.900000 for purposes of remediation or threat hunting. 0:14:55.900000 --> 0:14:59.920000 And with that being said, that brings us to the end of this video. 0:14:59.920000 --> 0:15:03.360000 Hopefully, you have a better understanding of what network analysis is, 0:15:03.360000 --> 0:15:06.760000 what it entails, the various, you know, at a high level, the various types 0:15:06.760000 --> 0:15:13.560000 of network data, data types, and you also have an understanding of the 0:15:13.560000 --> 0:15:16.140000 network based analysis methodology. 0:15:16.140000 --> 0:15:19.680000 So, with that being said, that's going to be it for this video, and I 0:15:19.680000 --> 0:15:21.740000 will be seeing you in the next video.