Cisco 200-201 - Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS)

Statistical data is crucial for detecting anomalies within a network because it provides a baseline of normal behavior.

Anomaly detection involves comparing current network data against historical statistical data to identify deviations from expected patterns.

This method helps in identifying unusual activities that could signify a security threat, such as unusual login attempts, data transfers, or access patterns.

Statistical data analysis tools use metrics such as mean, variance, and standard deviation to flag anomalies, aiding in proactive threat detection.

References

Cisco Cybersecurity Operations Fundamentals

Network Anomaly Detection Techniques

Statistical Methods in Cybersecurity

Vishing is an attack where fraudsters impersonate legitimate entities via phone calls to deceive individuals into providing sensitive information or performing actions that compromise security. References := Cisco Cybersecurity Source Documents

Session data is the data type that is necessary to get information about source/destination ports. Session data is the information about connections between hosts, such as IP addresses, ports, protocols, and duration. Session data can be used to identify the services and applications that are being used on the network, as well as the direction and volume of the traffic. Session data can also help to detect anomalous or malicious behavior, such as port scanning, brute force attacks, or data exfiltration. Session data can be collected from various sources, such as firewalls, routers, switches, or network monitoring tools. References:

Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) v1.0, Module 2: Security Monitoring, Lesson 2.2: Data Sources, Topic 2.2.2: Session Data (https://learningnetworkstore.cisco.com/on-demand-e-learning/understanding-cisco-cybersecurity-operations-fundamentals-cbrops-v1-0/CSCU-LP-CBROPS-V1-028093.html)

Cisco Certified CyberOps Associate Certification Guide, Chapter 3: Data Sources, Section 3.2: Session Data (https://www.ciscopress.com/store/cisco-certified-cyberops-associate-certification-guide-9780136807834)

In the NetFlow flow-record format, a dataflow set is a collection of data records that follow the template FlowSet in an export packet. Each data record corresponds to a flow and contains values for the fields defined in the template FlowSet. This allows for efficient organization and retrieval of flow information by NetFlow collectors.

Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS)

NetFlow Version 9 Flow-Record Format Documentation

tcpdump

➡️ full packet capture

Cisco Umbrella➡️ transaction data

stateful firewall➡️ connection event

Snort➡️ session data

Security monitoring relies on collecting different types of telemetry, each providing a unique level of visibility. These data types range from high-level connection summaries to full packet inspection, and different technologies are optimized for each purpose.

tcpdump is a command-line packet capture utility that records raw network packets directly from an interface. It captures complete packet payloads and headers, making it a full packet capture tool commonly used for deep forensic analysis and protocol troubleshooting.

Cisco Umbrella operates primarily at the DNS and web layer, logging requests, responses, destinations, and policy decisions. This information represents transaction data, showing what was requested, when, and whether it was allowed or blocked—without full packet payloads.

A stateful firewall tracks the state of network connections, such as session initiation, continuation, and termination. It records connection events, including source, destination, ports, and allow/deny decisions, which are critical for traffic flow analysis and incident scoping.

Snort is a network intrusion detection and prevention system (IDS/IPS) that analyzes traffic flows using rules and signatures. It tracks conversations and detects suspicious behavior across sessions, providing session data rather than raw packet captures.

Cybersecurity operations documentation emphasizes correlating these different data types to gain layered visibility, allowing SOC teams to detect, investigate, and respond to threats efficiently.

Windows Management Instrumentation (WMI) provides a unified way for users to request system information, including hardware and software inventory data. The Common Information Model (CIM) is an open standard that defines how managed elements in an IT environment are represented as a common set of objects and relationships between them. References: https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/admin_guide/b_ise_admin_guide_24/b_ise_admin_guide_24_new_chapter_01100.html