Investigations Flashcards
How does a vulnerability scanner find out which systems are vulnerable?
They are signature based.
Meaning they scan devices looking at very specific signatures for known vulnerabilities.
If the signature is not in their database then it won’t be reported and you will get a false negative.
Sometimes vulnerabilities can not be definitively identified, the scanner will give you a heads-up, and you will have to go check manually to see if a system is vulnerable.
Whats a dump file?
These are a log file that you can create on demand.
A memory dump file will store everything in the memory of an application of your choice.
You can do this in windows task manager by right clicking on a running process and then clicking “create dump file”.
Commonly used for troubleshooting
What is syslog?
Syslog is a standard for message logging.
Diverse systems create a consolidated log.
A standardized way of consolodating different types of log together.
Usually a central logging receiver (integrated into the SIEM)
What is “journalctl”?
This is a linux utility that allows you to read and search log files that are stored in binary format.
The standard format for storing system logs on LINUX is in BINARY.
Optimized for storage and queries.
Can’t read them with a text editor.
You will need journalctl to read system logs on linux.
What is bandwidth monitoring? name a few utilities than can do this
A way of measuring the percentage of network use over time.
SNMP
Netflow
sFlow
IPFIX
What is metadata?
Metadata is data that describes other data sources.
For example the metadata with an email would be:
Header details, destination address, etc.
What is a netflow? how does it work?
Think traffic statistics. Think information about how the network ~normally~ operates etc.
This is a word describing gathering traffic statistics from all traffic flows in your network and all shared communication between devices.
This is usually achieved by having “probe” devices on your network that watch the data and keep statistics, and then a “collector” which is a centralized netflow server which all of the summary records are sent to from the probes.
What is IPFIX?
IP Flow Information Export
This is a newer netflow-based standard
This allows us flexible data support and control over what data will be reported to a centralized server.
Same premise as netflow but more customizable.
What is sFlow?
Sampled Flow
This is kind of like netflow/IPFIX but not technically a flow.
Only a portion of the actual network traffic is taken into account for statistics to try and bring down overhead.
What is a protocol analyzer?
Wireshark is technically one of these.
This is a tricky way of saying packet analyzer.
Please don’t let this fool you.
Basically the same exact thing as a packet analyzer.
