Security Monitoring · Topic 3 of 8
Types of Security Monitoring Data
Learn the uses of full packet capture, session data, transaction data, statistical data, metadata and alert data in security monitoring and investigation.
- 4 min
- Full packet capture has the most detail and needs the most storage.
- Session data summarises conversations using the five tuple, times and byte counts.
- Transaction data shows individual requests and responses.
What it is
Security monitoring data comes in six common types, and each one trades detail against storage cost.
Full packet capture holds the most detail and costs the most to store. At the other end, alert data is small and points the analyst to something worth a look.
A good investigation moves between them. It starts with an alert, checks session or transaction records, and then goes to packets for proof.
How it works
Each data type answers a different question, so choose the type that fits the question.
Full packet capture
Full packet capture records every packet, including headers and payload. It allows an analyst to rebuild a file, a web page or an email that crossed the network.
It uses a lot of storage, so it is usually kept for a short time or only on key links. Encrypted payload stays unreadable.
Session data
Session data summarises a conversation between two endpoints. It records the five tuple, the start and end times, and the number of bytes and packets in each direction. NetFlow is a common source.
It answers who talked to whom, when and for how long. It is small enough to keep for months, so it suits long investigations and finding patterns.
Transaction data
Transaction data records the individual requests and responses inside a conversation. A web proxy log is an example, because it shows each URL requested and the response code. DNS logs show each name asked and answered.
The exam outline lists NetFlow as transaction data, while many sources call it session data. A flow record summarises one exchange, so either label can appear.
Transaction data adds application level detail that session data lacks, without storing the full payload.
Statistical data
Statistical data is a summary of behaviour over time, such as counts, averages and trends. Examples are bytes per hour, number of logins per day or the top talkers on a link.
It is used to build baselines and to spot anomalies. It tells you that something changed, not exactly what happened.
Metadata
Metadata is data about data.
For an email, it is the sender, recipient, time and subject, not the body. For a file, it is the name, size, owner and timestamps.
Metadata is cheap to store and still useful, even when the content is encrypted.
Alert data
Alert data is a notification produced when a tool matches a rule or a threshold. An intrusion prevention alert holds the signature that fired, the addresses involved and the time. Alerts can be false positives, so they need checking against other data.
| Data type | Detail level | Storage cost | Typical use |
|---|---|---|---|
| Full packet capture | Highest | Highest | Rebuild files, prove an attack |
| Session data | Medium | Low | Who talked to whom, long term trends |
| Transaction data | Medium to high | Medium | Requests and responses at application level |
| Statistical data | Low | Very low | Baselines and anomalies |
| Metadata | Low to medium | Low | Quick context, works on encrypted traffic |
| Alert data | Low | Very low | Starting point for investigation |
Choosing the right type
Match the question to the data.
- Was there a connection between these two hosts last month? Use session data.
- Which URL did the user request? Use transaction data.
- What exactly was in the downloaded file? Use full packet capture.
- Is this link busier than normal? Use statistical data.
What to remember for the exam
Seven facts cover most questions on this topic.
- Full packet capture has the most detail and needs the most storage.
- Session data summarises conversations using the five tuple, times and byte counts.
- Transaction data shows individual requests and responses.
- Statistical data supports baselines and anomaly detection.
- Metadata is data about data and is still useful when content is encrypted.
- Alert data is a notification that a rule or threshold matched.
- Investigations often start with alerts and move toward full packets.
To rebuild a file that crossed the network, only full packet capture will do.
Common mistakes
These four errors appear often.
Expecting session data to show content. It shows who talked to whom, not what was said.
Treating an alert as proof. Alerts can be false positives and need confirming.
Keeping full packet capture for months by default. Its storage cost usually limits it to short periods.
Ignoring metadata on encrypted traffic. Addresses, sizes and timing still tell a story.
The same tool can produce more than one type. A firewall can generate session records and alerts.
Check yourself
Work through these three questions.
Which data type lets an analyst rebuild a file that crossed the network?
Full packet capture, because it records every packet including the payload.
What does session data record?
A summary of a conversation, including the five tuple, times and byte and packet counts.
Why is statistical data useful?
It shows trends and baselines over time, so an analyst can spot activity that differs from normal.
Topic 3 of 8 in Security Monitoring
Test yourself on Security Monitoring
The full Cisco CCNA 200-201 CBROPS question bank has 754 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.