CompTIA · CySA+ CS0-004
Packet and log analysis tools
CySA+ CS0-004 · Lesson 6 of 22 · 42:01
YouTube loads only after you press play. This chapter opens at its timestamp in the full course. Watch on YouTube ↗
In this lesson
Prepare for the CySA+ CS0-004 exam (CompTIA Cybersecurity Analyst (CySA+)). In this lesson: decoding with CyberChef recipes, packet capture with tcpdump, Wireshark and its display filters, intrusion detection and prevention with Snort and Suricata, network security monitoring with Zeek, and the SIEM, to go from an alert to the exact bytes and the process behind them. Includes three original practice questions.
Preview the topics
- A Linux server with no graphical interface must capture all the traffic to port 53 for one hour, for analysis later on an analyst’s workstation. Which tool fits best on the server?
- The SOC wants to keep, for every connection on the network, who talked to whom, when, for how long, and with how many bytes, without writing any signatures. Which tool fits best?
- A PowerShell command line in the SIEM contains a long Base64 string, and the analyst needs to see what it does, without running it. What should the analyst use?