domains / families / security / analyzing-network-traffic-for-incidents

analyzing-network-traffic-for-incidents

separate

'Analyzes network traffic captures and flow data to identify adversary activity during security incidents, including

When to use

• SIEM alerts on anomalous network traffic patterns requiring deeper investigation
• C2 beaconing is suspected and needs confirmation through packet-level analysis
• Data exfiltration volume or destination must be quantified from network evidence
• Lateral movement between systems needs to be traced through network connections
• An IDS/IPS alert requires packet-level validation to confirm or dismiss

When not to use

• host-based forensic analysis
• process execution analysis
• file system artifact analysis

Skill page

Source