Hands-On Experience with Network Device Replacement (NDR) System Installation and Configuration
A Hands-On Exploration of Network Detection and Response
As a novice in network threat hunting, I embarked on a journey to gain hands-on experience with a network detection and response (NDR) system. My objective was to understand how NDR is utilized in hunting and incident response, and how it integrates into the daily workflow of a Security Operations Center (SOC). I had the opportunity to work with Corelight’s Investigator software, part of its Open NDR Platform, which is designed to be user-friendly for junior analysts.
The Role of NDR in SOC Workflows
NDR systems are a crucial component of mid- to elite-level security operations, playing a key role in incident response and threat hunting workflows. These systems provide deep visibility across networks, detecting intrusions and anomalies, and helping analysts triage and respond to potential threats. NDR’s visibility is essential for spotting complex attacks and uncovering misconfigurations or vulnerabilities that can lead to breaches or outages.
Getting Started with the NDR System
Upon launching Investigator, I was greeted by a dashboard displaying a ranked list of the latest high-risk detections, listed by IP address and frequency of occurrence. Most investigations begin with a suspicious activity on the network triggering an alert, prompting an analyst to form a hypothesis about the potential threat. I was able to click through the list and view robust details about the specific issues flagged, including evidence of exploit tools, reverse command shells, and suspicious IP addresses.
The Power of AI-Driven Insights
Investigator’s AI-driven features were a significant asset in my investigation. I could ask pre-set questions, such as “What type of attack is associated with this alert?” and receive detailed responses. The AI provided actionable next steps, clarifying the investigation process and allowing me to focus on my analysis. The AI-driven hints were truly useful, not annoying, and helped me build and explain the narrative of an attack.
Exploring Anomaly Detection and Command Line Capabilities
Investigator comes with dozens of specialized dashboards that enable deeper analysis, including three dashboards related to anomaly detection. I also explored the command line panel, where I could search for specific conditions using sample command strings from Corelight’s Threat Hunting Guide. This feature helped me become more familiar with the data and use it to threat hunt unknown attacks in the future.
The Benefits of NDR: Enrichment and Integration
An NDR platform provides two significant benefits: enrichment and integration. Each network connection is enriched with data collected by Investigator, including IP addresses, activity, and context. This enrichment allows for the correlation of a particular alert with other parts of the network, helping analysts determine whether an anomaly is a legitimate threat. Integrations with other security tools, such as endpoint detection and response (EDR), enable the identification of compromised hosts or endpoints.
Conclusion
My hands-on experience with Corelight’s Investigator taught me valuable lessons on how to create threat hypotheses, understand how threats move about a network, and defend networks in the modern era. While I am not ready to become a network security analyst just yet, I gained a deeper appreciation for the day-to-day work of a SOC analyst and the importance of NDR systems in their workflow.
About Author
English