Flow Visualization Using MS-Excel - Cert

More documents

Recommendations

Info

Data FormattingColumns within the spreadsheet should be aligned to each field of theflows, Einstein data is formatted to encompass:• Source IP• DestinationIP• Source Port• DestinationPort• Protocol• Packets• Bytes• Flags• Start Time• Duration• End Time• Sensor• Type• Initial Flags
Data Formatting Cont.US-CERT analysts use two methods to format the Einstein timefields into a format that is able to be plotted:A: Use the - - legacy-timestamps switch to place the time in aMM/DD/YYYY HH:MM:SS format from the default MM/DD/YYYYTHH:MM:SS.MMMB: Utilize the replace function in excel to remove the milliseconds from the timeand replace the T placeholder with a space:
Page 1 and 2: Flow Visualization Using MS-ExcelVi
Page 3 and 4: Pro’s and Con’s• Pro’s:- Vi
Page 5 and 6: Data PullAnalysts have several opti
Page 7: Importing DataData is imported from
Page 11 and 12: PlotCreating charts from theselecte
Page 13 and 14: HighlightBy hovering over a data po
Page 16 and 17: Byte Based Patterns
Page 18 and 19: sPort vs. dPort
Page 20 and 21: Comprehensive View
Page 22 and 23: Multi-day ViewWorkday Week endWorkd
Page 24 and 25: Additional AnalysisDetermining appl
Page 26 and 27: Structured Gateway
Page 28 and 29: Gateway Mannerisms
Page 30 and 31: Split View
Page 32 and 33: Application ColoringGreen = HTTP, B
Page 34 and 35: Colorization Example - GW2IP
Page 36: Questions?

Flow Visualization Using MS-Excel - Cert

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?