An analyst is investigating an incident in a SOC environment. Which method is used to identify a session from a group of logs?

In network security analysis, a session or flow is a unique communication stream between two endpoints. This stream is uniquely identified by the 5-tuple, which consists of five key elements: source IP address, destination IP address, source port number, destination port number, and the transport layer protocol (e.g., TCP, UDP). When a Security Operations Center (SOC) analyst examines logs from firewalls, NetFlow, or intrusion detection systems, they use the 5-tuple to isolate and track a specific conversation from potentially millions of other log entries, enabling precise incident investigation.

A. sequence numbers: These are used to order and reassemble packets within an established TCP session, not to identify the session itself.
B. IP identifier: This field in the IP header is used to identify fragments of a single, original IP datagram, not the entire communication session.
D. timestamps: These indicate when an event occurred and are used for temporal correlation, but they do not uniquely identify a session.

1. Santos

O. (2020). Cisco CyberOps Associate CBROPS 200-201 Official Cert Guide. Cisco Press.

Reference: Chapter 10

"Network Intrusion Analysis

" Section "What Is a Flow?". The text states

"A flow is a sequence of packets that have a set of common properties passing through a network device. These properties are known as the 5-tuple

and they consist of the same source IP address

destination IP address

source port

destination port

and protocol."

2. Cisco. (2021). Cisco IOS Flexible NetFlow Configuration Guide.

Reference: "Flexible NetFlow Overview" section. The documentation defines a flow as "a unidirectional stream of packets between a given source and a destination." It specifies that a flow is identified by key fields

which include the core components of the 5-tuple (source/destination IP

source/destination port

and protocol).

3. Kurose

J. F.

& Ross

K. W. (2017). Computer Networking: A Top-Down Approach (7th ed.). Pearson.

Reference: Chapter 4

"The Network Layer: Data Plane

" Section 4.4 "Generalized Forwarding and SDN." The text describes how network switches and routers can match packet header fields for forwarding decisions

stating

"A flow of packets is defined by the values of selected header fields... For example

a flow could be defined by the source and destination IP addresses and the source and destination port numbers." This directly references the components of the 5-tuple.