Alert identification

There are a variety of different ways in which an alert can be identified. Different types of incidents will tend to be associated with different artifact elements, which can be used to identify them. This section will cover some of the common artifacts associated with alerts, and what they can be used to indicate.

Remember those artifact elements are only an indication and can have greater or lesser degrees of accuracy and precision.

Network indicators

This section discusses identifying features of threats in network headers. These do not require inspection of the payload. While detecting threats and alerting system administrators is never done in isolation, the split between network indicators and...