Network Intrusion Analysis · Topic 1 of 7
Event Sources and Alert Outcomes
Map events to sources such as IDS, IPS, firewall, proxy, antivirus and NetFlow, and classify alerts as true or false positives and negatives.
- 5 min
- An IPS or IDS alert names a signature, and a firewall log shows allow or deny.
- A proxy log shows users and URLs, and antivirus logs show threat names and hashes.
- NetFlow shows conversation summaries and no payload.
What it is
Every event in a security tool comes from a specific source, and every alert has an outcome that says whether it was right.
An analyst first asks which technology produced the record, because that shows what the record can and cannot tell them. They then decide whether the alert was correct and what the impact was.
This page covers both skills. The first is mapping events to sources, and the second is naming the outcome of an alert.
How it works
Each source has a typical log style, and each alert falls into one of four outcomes.
Mapping events to source technologies
| Source | What it records | Typical content |
|---|---|---|
| IDS or IPS | Traffic that matches a signature or anomaly rule | Signature name, priority, source and destination, ports, action taken |
| Firewall | Connections allowed or denied by policy | Addresses, ports, protocol, allow or deny, rule or interface |
| Network application control | Applications seen in traffic | Application name, user, bandwidth, allow or block |
| Proxy | Web requests made through it | User, URL, method, response code, category, bytes |
| Antivirus | Files and processes that match a detection | File name, hash, threat name, action such as quarantine |
| NetFlow (transaction data in the outline) | Conversation summaries | Five tuple, bytes, packets, start and end time |
Two Cisco ASA firewall messages show the style. The first records a built connection, with the real and mapped address in brackets, and the second records a deny by an access list. Real messages can carry extra fields, and the layout can vary by software version.
%ASA-6-302013: Built inbound TCP connection 1234 for outside:203.0.113.5/52814 (203.0.113.5/52814) to inside:10.1.1.10/443 (10.1.1.10/443)
%ASA-4-106023: Deny tcp src outside:203.0.113.5/52814 dst inside:10.1.1.10/23 by access-group "OUTSIDE_IN"A proxy log, by contrast, shows the user and the full web address requested, which a firewall may not show. An IPS alert names the signature, which tells you what attack the sensor thinks it saw. NetFlow shows only the conversation and has no payload.
Clues in the record point to the source.
- A signature name or priority points to an IDS or IPS.
- Allow or deny with an interface or rule points to a firewall.
- A URL, user and response code points to a proxy.
- A threat name and file hash points to antivirus.
- Byte and packet counts with no content point to NetFlow.
Alert outcomes
An alert can be right or wrong, and the real event can be an attack or not.
| Outcome | Alert raised | Real attack | Impact |
|---|---|---|---|
| True positive | Yes | Yes | Impact. A real attack was caught |
| False positive | Yes | No | No attack impact, but analyst time is wasted |
| True negative | No | No | No impact. Normal traffic passed quietly |
| False negative | No | Yes | Impact. A real attack was missed |
| Benign | Yes or no | The activity is legitimate | No impact |
A true positive means that the tool was correct that an attack occurred. A false positive means the tool raised an alarm for harmless activity.
A false negative is the most dangerous, because a real attack went undetected and no one is looking. A true negative means nothing happened and nothing was raised.
Benign describes activity that is legitimate, such as a vulnerability scan run by the security team. It may still trigger an alert, but it is not an attack.
Reducing wrong outcomes
Tuning a tool changes the balance between false positives and false negatives. Loosening a rule lowers false positives but may raise false negatives. Tightening it does the opposite.
Analysts reduce false positives by tuning signatures and allow listing known good activity. They reduce false negatives by adding sources, updating signatures and adding behavioural detection.
A worked example helps.
An IPS alerts on an SQL injection signature in a request to the web server, and the server logs show a database error. That is a true positive. The same signature firing on a penetration test that was approved is benign activity.
What to remember for the exam
Seven facts cover most questions on this topic.
- An IPS or IDS alert names a signature, and a firewall log shows allow or deny.
- A proxy log shows users and URLs, and antivirus logs show threat names and hashes.
- NetFlow shows conversation summaries and no payload.
- A true positive is a correct alert on a real attack.
- A false positive is an alert on harmless activity.
- A false negative is a missed attack and is the most dangerous outcome.
- A true negative is no alert on normal traffic, and benign activity is legitimate.
The first word tells you if the tool was right. The second word tells you what the tool said. A false negative means the tool said no, and was wrong.
Common mistakes
These four errors appear often.
Calling a missed attack a false positive. A missed attack is a false negative.
Treating every alert as an attack. Many alerts are false positives or benign activity.
Forgetting that false negatives leave no trace. Nothing is raised, so they are hard to notice.
Mixing up the source of a log. Read the fields, since a URL points to a proxy and a signature points to an IPS.
Tuning to remove all false positives can create false negatives, so change rules with care.
Check yourself
Work through these three questions.
What is a false negative, and why is it dangerous?
It is a real attack that raised no alert. It is dangerous because nobody knows that it happened.
Which source shows the user and the full URL for a web request?
A proxy log shows the user, the URL and the response code.
How do a true positive and a false positive differ?
A true positive is an alert on a real attack. A false positive is an alert on harmless activity.
Topic 1 of 7 in Network Intrusion Analysis
Test yourself on Network Intrusion Analysis
The full Cisco CCNA 200-201 CBROPS question bank has 754 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.