Networking: The netstat Command

allows you to view stats for TCP/IP protocols on a system.

displays a listing of all TCP and UDP ports that a system is listening on.

displays the routing table

displays details on network stats, including how many bytes the system sent and received.

displays stats of packets sent or received for specific protocols, such as IP,ICMP, TCP and UDP

displays addresses and port numbers in \nnumerical order

shows stats on a specific protocol, such as TCP or UDP.

it has to display ESTABLISHED

1. ESTABLISHED 2.LISTEN 3. CLOSE_WAIT 4. TIME_WAIT 5. SYN_SENT 6. SYN_RECEIVED

if you suspect malware is causing a computer to connect with a remote computer

this is the normal state for the data transfer phase of a connection. it indicates an active open connection.

indicates the system is waiting for a connection request.

indicates the system is waiting for a connection termination request.

indicates the system is waiting for enough time to pass to be sure the remote system received a TCP–Based acknowledgment of the connection.

this indicates the system sent a TCP Syn packet as the first part of the SYN, SYN–ACK, ACK handshake process and it is waiting for the SYN–ACK response

indicates the system sent a TCP SYN–ACK packet after receiving a syn packet as the first part of the SYN, SYN–ACK, ACK handshake process.

lists all the routers between systems.

same thing as tracert but for linux–based systems

tracert is for windows and traceroute is for linux

to identify faulty routers on the network.

if paths have been modified.

by using the tracert command

combines the function of the ping and tracert command.

to locate potential problems in the path \nbetween 2 systems.

a command–line tool that is related to the address resolution protocol.

view and manipulate the ARP cache.

if you suspect a system's ARP cache has been modified during an attack.

it's an acronym for LINUX, Apache, MySQL, and PHP or perk or python.

it's used to display the contents of files.

allows you to run the command with elevated privileges.

(Short for globally search a regular expression and print) is used to search for a specific string or pattern of text within a file.

allows you to see the beginning of a log file. the default is the first 10 lines.

allows you to display the last 10 lines of a log file.

to add entries in the /var/log/syslog file from the terminal or form scripts and applications.

queries the linux system logging utility and displays log entries from several sources.

used to modify permissions on linux system files and folders.

it records auditable events such as successes or failures. functions as a security log, audit log, and access log.

used by the operating system to record events related to the functioning of the operating system.

records events sent to it by applications or programs running on the system.

record traffic on the network.

provides a centralized solution for collecting, analyzing, and managing data from multiple sources.

1. Log collectors 2. Data Inputs 3. Log aggregation 4. correlation engine 5. reports 6. packet capture 7. User behavior analysis 8. sentiment analysis 9. security monitoring 10. automated triggers 11. time synchronization 12. event deduplication 13. logs/WORM

SIEM collects log data from devices throughout the network and stores these logs in a searchable database.

Log entries come from various sources. they can also come from any system that an organization wants to monitor.

aggregation refers to combining several dissimilar items into a single similar format. stores data so it is easy to analyze and search.

a software component used to collect and\n analyze event log data from various systems within the network.

include multiple built–in reports. typically grouped in different categories.

protocol analyzers capture network traffic allowing admins to view and analyze individual packets.

focus on what users are doing, such as what applications they are launching and their network activity.

refers to analyzing text to detect an opinion or emotion. within a SIEM system, it refers to using UBA tech to observe user behaviors to detect \nunwanted behavior.

provide continuous monitoring of systems and provide notifications of suspicious events.

triggers cause an action in response to \na predefined number of repeated events.

all servers sending data to the SIEM should be synchronized with the same time.

the process of removing duplicate entries.

1. Sensors 2. Alerts 3. Sensitivity 4. correlation 5. trends

these collect logs from devices and send these logs to the SIEM system.

after setting triggers in a SIEM system, it sends out alerts when the event fires.

a challenge with triggers and alerts is setting the sensitivity levels to limit false positives while avoiding false negatives.

as log entries arrive at the SIEM system, it correlates and analyzes the data.

as the SIEM system is analyzing the data, it can identify trends.

specifies a general log entry format and the \ndetails on how to transport log entries. you can deploy a centralized syslog server to collect syslog entries from a variety of devices in the network.

it only defines how to format the syslog messages and send them to a collector. it doesn't define how the syslog server handles these log entries.

handles the syslog messages. it collects the entries and processes them based on entries in the /etc/syslog.conf file.

extends syslogd, allowing a system to collect logs from any source.

came out later as an improvement over \nsyslog–ng. one big change is the ability to send log entries directly into database engines.

another log management tool and is similar to rsyslog and syslog–ng. however, supports log formats for windows.