offline:wrccdc_pcaps_results
Differences
This shows you the differences between two versions of the page.
Both sides previous revisionPrevious revisionNext revision | Previous revisionNext revisionBoth sides next revision | ||
offline:wrccdc_pcaps_results [2018/05/12 23:41] – [Viewing IDS Alerts] veera | offline:wrccdc_pcaps_results [2018/05/12 23:58] – [File Extraction] veera | ||
---|---|---|---|
Line 58: | Line 58: | ||
==== Retro Analysis - view advanced counters ==== | ==== Retro Analysis - view advanced counters ==== | ||
+ | |||
+ | //To open : Retro > Retro Counters // | ||
+ | |||
+ | The retro analysis tools let you select arbitrary timeframe in the past and then drilldown into that. Since TrisulNSM is a streaming analytics tool, it can handle very large timeframes easily compared to search based tools. | ||
[{{ : | [{{ : | ||
- | Here we are seeing | + | You have to select a time frame from the bandwidth chart and then select one of the 40+ " |
[{{ : | [{{ : | ||
===== Drilldown techniques ===== | ===== Drilldown techniques ===== | ||
+ | Once you have a fairly solid baseline you can go back and decide which paths you want to follow to drilldown further. You might be interested in first checking out the critical IDS alerts, or tracking down flows. This section introduces you to the tools you will use for the drilldowns. | ||
==== Explore flows ==== | ==== Explore flows ==== | ||
+ | |||
+ | Most of the times you want to first drop down to the flow level. This can be accessed by " | ||
[{{ : | [{{ : | ||
==== Trisul EDGE: Graph analytics discover relationships ==== | ==== Trisul EDGE: Graph analytics discover relationships ==== | ||
+ | |||
+ | We recently added Graph Analytics to Trisul. This solves a common question that analysts ask from any " | ||
[{{ : | [{{ : | ||
==== File Extraction ==== | ==== File Extraction ==== | ||
- | + | ||
+ | Trisul has the ability using the "Save Binaries" | ||
[{{ : | [{{ : | ||
- | + | The extracted files are stored by the app in ''/ | |
- | ==== Drilldown | + | |
- | |||
- | [{{ : | ||
- | |||
- | |||
- | ==== File extraction ==== | ||
< | < | ||
Line 100: | Line 104: | ||
</ | </ | ||
+ | |||
+ | |||
+ | |||
+ | ==== Drilldown to Packets ==== | ||
+ | |||
+ | |||
+ | [{{ : | ||
offline/wrccdc_pcaps_results.txt · Last modified: 2018/05/13 00:08 by veera