Detection related tools - secuguru/security-terms GitHub Wiki

In cybersecurity, detection tools are used to monitor, analyze, and alert on potential threats in real-time or during investigations. These tools help security teams detect anomalies, attacks, and breaches by analyzing logs, network traffic, and system behaviors. Below is an overview of some key detection-related tools and their functions:

• Type: SIEM (Security Information and Event Management) / Log Management
• Description: Splunk is a powerful platform for searching, monitoring, and analyzing machine-generated data, including logs, metrics, and events from various systems. It provides real-time visibility into an organization’s IT infrastructure and can be used for security monitoring, threat detection, and incident response.
• Features:
  • Centralized log management and aggregation.
  • Real-time search and analysis.
  • Dashboards for visualizing security metrics and alerts.
  • Integrates with various data sources, making it versatile for detecting security incidents.

• Type: SIEM
• Description: ArcSight (by Micro Focus) is an enterprise-level SIEM platform that helps organizations detect, respond to, and mitigate security threats. It collects and correlates data from various sources to provide comprehensive threat detection capabilities.
• Features:
  • Advanced correlation engine for detecting security incidents.
  • Centralized event management and real-time alerting.
  • Scalable architecture for large organizations.
  • Used to perform forensic analysis and compliance reporting.

• Type: SIEM
• Description: IBM QRadar is another leading SIEM tool used for log management, threat detection, and security intelligence. It analyzes security data from various sources and applies advanced analytics to detect anomalies and attacks in real-time.
• Features:
  • Collects data from logs, network flows, and user activities.
  • Uses machine learning and behavioral analytics for threat detection.
  • Automatically correlates events to provide actionable insights.
  • Supports incident investigation and forensics by correlating events across different data sources.

• Type: AI-based Network Detection and Response (NDR)
• Description: Darktrace is a cybersecurity platform that uses artificial intelligence (AI) to detect threats in real-time across enterprise networks. It builds a model of “normal” network behavior and detects anomalous activity that deviates from this baseline.
• Features:
  • Uses unsupervised machine learning for detecting unknown threats.
  • Monitors network traffic to detect internal and external threats.
  • Capable of detecting insider threats, malware, and zero-day attacks.
  • Provides autonomous responses to threats through its Antigena module, automatically containing threats.

• Type: Packet Sniffer / Network Traffic Analysis
• Description: Tcpdump is a command-line tool used to capture and analyze network traffic at the packet level. It is widely used by security professionals for network troubleshooting and incident investigation.
• Features:
  • Captures network packets in real-time and allows deep inspection of network traffic.
  • Supports filtering by protocol, IP addresses, ports, etc.
  • Useful for detecting traffic anomalies, unauthorized communications, and potential attacks.
  • Often used in conjunction with other tools like Wireshark for deeper analysis.

• Type: Packet Analyzer
• Description: Wireshark is one of the most popular and powerful GUI-based packet analyzers. It captures and analyzes network traffic in real-time and provides a detailed view of packet-level data.
• Features:
  • Captures packets from live network traffic and provides deep inspection capabilities.
  • Supports a wide variety of network protocols, allowing detailed traffic analysis.
  • Provides filtering, searching, and visualization features to detect anomalies and investigate suspicious activities.
  • Useful for detecting attacks like man-in-the-middle, DNS poisoning, and traffic injection.

• Type: Network Security Monitor
• Description: Zeek is an open-source network monitoring and traffic analysis framework designed to detect intrusions by inspecting network traffic. Unlike packet analyzers, Zeek focuses more on analyzing higher-level events and producing structured logs.
• Features:
  • Monitors network traffic and generates logs with detailed metadata about network activities.
  • Detects network intrusions by analyzing patterns of traffic behavior.
  • Provides event-based logs, which are easier to correlate and analyze than raw packet captures.
  • Useful for detecting threats like scanning, DDoS, lateral movement, and command-and-control (C2) traffic.

• Splunk, ArcSight, and QRadar: SIEM tools that aggregate and correlate logs from multiple sources, providing real-time threat detection and incident response capabilities.
• Darktrace: AI-driven platform that detects network anomalies and threats by modeling normal behavior and identifying deviations.
• Tcpdump and Wireshark: Packet capture and analysis tools used to inspect network traffic at a granular level, identifying suspicious or malicious network activity.
• Zeek: Network security monitor that analyzes traffic patterns and generates logs to detect network intrusions and suspicious activities.

Each of these tools plays a critical role in detecting, analyzing, and responding to potential threats in a cybersecurity environment, providing insights into logs, network traffic, and system behaviors.