ddresses appear to be sending the data and who are the recipients of the data. How long has this been taking place? Are there past cases? Are there other anomalies or is there threat intelligence associated with the addresses? Are there other events that have been identified as security relevant that have similar characteristics? Do the TCP sessions look legitimate and complete, or do they have indications of failed connec- tions or perhaps no successful connections? Were there successful connections prior to the anomaly? Network Security Remediation Visualizations Data subset Anomalies Alerts & Future and reports Prevention Data Pre-filter Anomaly Details Collection / Interpretation / Selection Response Action Detection Characterization Pre-define what Select appropriate Baseline normal Use rules engine to Based on knowledge of actions to take in data types to be activity and find flag interpret details to identified anomalies, determine cause, specific circumstances. processed. Also may activity. Signatures fit gather related data select/filter a segment into this category as implications, and These may be as and slice the data in of data. Metadata well. This seems to get potentially initiate simple as alerting a other directions to response team that generation is also a the most attention. response variation of selection generate a profile of will make judgements the anomalous activity. on response, or could (e.g., field selection). use workflow management to automate. FIGURE 9.13 Generic security analysis algorithm template. Interpretation is perhaps the most difficult step in the processes. Neither a system nor people can accurately interpret a situation with insufficient information. Often manual processes are introduced not because of lack of automation, but because the infor- mation needed to make a decision come from sources external to the analysis envi- ronment. If analysts need to consult with people to make an interpretation, then this generally cannot be automated until the information those people