In this lesson,
we're going to take a look at an IPS or IDS log,
and we're basically going to do that by using a sample question
to see if you can understand how to take apart one
of these questions during your exam.
Now, in this question we're going to be asked which
of the following event IDs represents the biggest threat
to your organization's enterprise network
and should be investigate immediately
by the organization's cybersecurity analysts.
Then we see a whole bunch of different events here,
and we see the date, the time, the severity, the event ID,
the description, and the action taken.
Based on all of this,
you would get a multiple choice question
with four different event IDs,
and you would then select out of those event IDs,
which one is the most severe for your organization.
But to make this a little bit more challenging,
we're not going to give you four choices here.
I'm actually going to let you choose from any
of these event IDs to see if you're correct.
So what I'd like you to do here is pause the video
for a moment and then come back when you have the event ID
that you think is the most severe,
and then I'm going to give you the right answer
and explain why it was right.
Alright, are you back with me now?
You ready to see the right answer?
Well, the right answer here is actually going to be one
of the high severity ones, but which one?
There's actually six different high severity alerts here
that were detected by this IDS or IPS.
And in this case, because it is blocking action,
we know this is an IPS or an intrusion prevention system
and not an IDS an intrusion detection system.
So which of our six highs is going to be the one
that is the most dangerous for us?
Well, in this case, it's actually going
to be the data exfiltration detection at line 4130.
Now it's not just because this was a high severity though,
because we had six different high severities.
So let's take a look at each of those six
and then we could talk about why data exfiltration
was the right answer.
Now, the first high we had was up at the second line,
which is line 4105,
and you see the description
as an SQL injection attack detected.
Now, normally that would be a very severe thing
because it has to do with our database
and people could try to attack our database
through an SQL injection and then take our data out of it.
But this was actually blocked,
and since it was blocked by the IPS,
it's really not a big deal
because the IPS protected us like it was supposed to.
So we can say that one is not that dangerous
and we'll move it down the list.
Let's go to the next high.
The next high we have is 4110,
which is a buffer overflow attack, which again,
is another serious issue,
but again, it was blocked by the IPS
and therefore it's not an issue for our systems.
It wasn't successful in running
that attack even though the attack was attempted.
The next one we have is another high at 4115,
and it was anomalous privilege escalation detected.
This means somebody was able
to go from a regular account into a administrative account
or from a guest user into an authenticated user.
But again, either way, this was blocked by the IPS.
So once again, it doesn't affect our systems
and we can then push that to the side
and look at the next high.
The next high we have is 4120,
which was an external brute force attack,
and again, it was blocked.
And so you're seeing the pattern here.
If it was blocked, it's not as big of a deal for us
because that was stopped by our defenses.
Now, one of the things you do want to keep in mind though is
even though these things are being blocked,
you would want to see who is doing these attacks.
And if it's the same person, you may want to go ahead
and add in something like blocking their IP address
or doing other things to prevent them
from even getting to your IPS.
But again, the IPS was doing its job here
by blocking those issues.
The next high we have is 4125,
which was a network scan being conducted
from an internal IP.
Honestly, a network scan is not really that big of a deal.
It can be an indication that somebody is going to attack you
because they're performing reconnaissance,
but the scan itself is not that dangerous.
And again, here the IPS was able to contain that for us,
so it wasn't really affecting our systems.
And then finally we get to the high of 4130,
which was the data exfiltration detected.
It was an alert, not a block, and the admin was notified.
So at this point, because it alerted on it,
we need to go take action on it.
If you look through some of the other ones,
you do see some others that were alerted or monitored.
In the case of the medium severity incident at 3301
in the middle of this page,
you could see there was an ICMP Echo (Ping) Request Flood,
and that was monitored.
So this is something that was happening
and we saw it happen, but we didn't stop it.
Now again, this is just an echo request,
which basically means they're trying to flood you
with echo requests and it would be an issue,
but it's not a major issue like a data breach is.
So again, the data breach will be much more important.
And then as we look at some of the other ones that alerted.
We had unusual outbound traffic patterns.
We had excessive login attempts.
We had suspicious file download activity.
We had things like insecure protocols being detected,
like maybe somebody was using Telnet instead of SSH,
and we had ARP spoofing attempts detected,
and we had unusual inbound traffic patterns
and we had multiple insecure login attempts.
All of those were issues, but they were either medium or low
and they were alerted on, but they weren't blocked.
But because we had that high data exfiltration
and it was an alert and not a block,
that becomes our most significant one
and the one that we need to
focus our investigations on first
with our cybersecurity analysts to be able
to determine was it successful?
Were they able to exfiltrate data?
And if so, how much data, and what kind of data?
Because now we'll be in the middle of an incident response
and try to clean up from this data exfiltration
that happened and that was actually able to go
through our IPS.
So we're going to want to retune our IDS to block
that in the future and not allow
those kind of things from happening.
All right. If you get something like this on the exam,
remember they're going to give you four choices
and out of those four choices,
you might get four highs here.
And what you want to look for is were these blocked?
If they were blocked, it's already been mitigated
and it didn't have an effect on your network.
But if it was an alert or a monitor,
that means it made it through
that network security appliance
and it actually had an effect on your network,
so you need to investigate it and figure out what they took
and what they're able to steal
during that data exfiltration.