Chapter 2 - Understanding NSM Tools and Data

Question 1

Software that collects, maintains, processes, and presents network security data.

Answer 1

Network Security Monitoring software

Question 2

Name the six common NSM data types

Answer 2

Session data, Packet Capture, Transaction, Alert, Statistical, and Metadata

Question 3

Describe Session data

Answer 3

Summary data associated with network conversations that included who talked with whom and when. Usually includes at least the IP 5-tuple.

Question 4

Describe Transaction data

Answer 4

This lies between session data and packet capture. Most commonly seen as web, DNS, or SMTP server logs.

Question 5

Describe Alert data

Answer 5

Alert data is generally produced by IPS systems and are generated when certain conditions match a specific signature.

Question 6

Describe Statistical data

Answer 6

Statistical data is summaries over period of time usually presented as graphs or overall numbers.

Question 7

Describe Metadata

Answer 7

Metadata is data about data. Examples include Geolocation data, reputation scores, and IP/Network ownerships.

Question 8

What is described as bringing together multiple data types and multiple data sources to reveal all event/incident information?

Answer 8

Correlation