← soc analyst

Network Analysis for SOC

intermediate 5h

Parse Zeek logs, Suricata alerts, and flow data to investigate C2 beaconing, data exfiltration, lateral movement, and DNS anomalies — and write network-layer containment actions.

After this module you will

  • › Navigate Zeek log schemas (conn, dns, http, ssl, files) and pivot between them
  • › Identify C2 beaconing from flow data using statistical analysis
  • › Distinguish DNS tunnelling, DNS exfiltration, and DGA from normal DNS traffic
  • › Detect and classify TLS-encrypted C2 using JA3/JA4 and certificate metadata
  • › Identify lateral movement indicators in network flows
  • › Write network-layer containment actions with precise firewall and DNS block specifications

Lessons

1 Zeek Log Schema — Navigation and Pivot Chains
25 min
2 C2 Beaconing Detection — Statistics and Signatures
30 min
3 DNS Anomaly Analysis — DGA, Tunnelling, and Fast-Flux
25 min
4 Lateral Movement — Network Signatures and Detection
25 min
5 Data Exfiltration Detection — Volume, Protocol, and Destination
25 min
6 Network Containment Actions — Blocks, Blocks, and What to Block
20 min

Module Quiz

Test your knowledge before moving on.

Take Quiz →