Compare signature, anomaly, and behavior-based detection.
Place sensors where they answer useful questions.
Balance prevention, false positives, and response.
Network detection systems inspect flows, packets, names, identities, and behavior for signs of compromise. Signatures are precise for known patterns; anomaly detection can find novel behavior but needs context and tuning. Prevention controls can block traffic, but a false positive can interrupt critical business operations.
alert: service-account data volume 10x baseline
investigate: identity, source, destination, time, change history
respond: contain, verify, recover
Use sensors at boundaries, between sensitive segments, and near important services. Protect telemetry itself, synchronize time, retain enough context, and define escalation. Detection without an owner or response path is noise.
Exercises
Design detections for scanning, credential abuse, and exfiltration.
Choose sensor locations for a three-tier application.
Define false-positive tuning and escalation.
Self-check
What is a signature?
Why is context important?
What makes an alert actionable?
Self-Check Quiz
1. What can anomaly detection find?
AnswerBehavior that differs from a baseline, including novel activity, though it requires tuning and context.
2. Why protect telemetry?
AnswerLogs and alerts contain sensitive evidence and can be altered to hide an attack if not protected.
Homework
Create a network detection plan for an enterprise.
Define five alerts with owner, evidence, and response.
Explain one risk of automatic blocking.
Sample answerAlerts should identify actor, source, destination, resource, time, baseline, and confidence, then route to a named responder. Automatic blocking can stop an attack but may cause an outage or hide evidence, so high-impact actions need tested thresholds and safe rollback.