Simple explanation
Once you know what to look for, you need the right tool for the job. This lesson covers the actual toolkit — from packet capture to log analysis — a CySA+ analyst is expected to know how and when to use.
Technical explanation
- Packet capture (PCAP) — tools like Wireshark (GUI-based analysis) and tcpdump (command-line capture) record raw network traffic for the deepest level of investigation detail.
- Vulnerability scanners — identify known weaknesses across the environment (covered in depth in Domain 2).
- Endpoint Detection and Response (EDR) — provides deep visibility and response capability at the individual host level.
- Packet analyzers — tools that parse and interpret captured traffic beyond raw bytes.
- IDS/IPS — signature and anomaly-based network detection (and, for IPS, blocking).
- Firewall logs — show what traffic was allowed or denied at network boundaries.
- File Integrity Monitoring (FIM) — flags unexpected changes to critical files.
- Log analysis — correlating events across multiple log sources, usually via a SIEM, to build a timeline.
- Impact analysis — determining the actual business/technical consequence of a confirmed finding, not just its technical existence.
- DNS/IP reputation services — checking whether a domain or IP has a known-malicious history before or during investigation.
- Email analysis — examining headers, links, and attachments in a suspicious message (covered more in Security+ but directly relevant here too).
- Pattern recognition and command-and-control (C2) detection — techniques for spotting the underlying attack structure across multiple data sources rather than relying on a single tool's alert.
Synonyms / related terms
| Term | Means | |---|---| | PCAP | Packet Capture | | EDR | Endpoint Detection and Response | | FIM | File Integrity Monitoring |
Concept Check
"An analyst needs to confirm exactly what data left the network during a suspected exfiltration event, down to the byte level." Log analysis alone (which typically records metadata, not full content) isn't sufficient here — packet capture is the tool that provides that level of granular detail, assuming it was being collected at the time.
Interview-style Q&A
Q: When would you reach for tcpdump instead of Wireshark? A: "tcpdump is scriptable and lightweight — I'd use it directly on a server over SSH to capture traffic in a live environment without a GUI, or to automate capture as part of a larger script. Wireshark is what I'd actually use afterward to dig through that capture visually, filter it, and follow specific streams — they're often used together, capture with one, analyze with the other."
Memory trick
"Packets, Points (endpoints), Patterns, Ports (firewall)" — four Ps covering the major tool categories: packet capture, endpoint tools, pattern/log analysis, and network boundary tools.