Lesson 5.5: Capstone: scope, contain and report a network intrusion
Everything in this course comes together on fw01, Northwind's Linux edge firewall. Using the Zeek logs from section 1 you establish the scope: which internal machines talked to the attacker's infrastructure. A fresh packet capture shows whether the intrusion is still active. Then you contain it at the edge with nftables sets (block the attacker's addresses, quarantine the two hosts), make the change persistent, and write a sealed report that tells the incident team what happened, what's done and what comes next.
22 min
You will learn to
- Scope an intrusion from network logs
- Confirm current activity with a capture
- Contain with nftables sets at the edge
- Persist and verify the change
- Write and seal a network investigation report
Key terms
- Scoping
- Finding every system and account involved in an incident.
- Containment
- Stopping an incident from spreading or continuing, before eradication and recovery.
- Quarantine
- Isolating a host from the network while keeping it for analysis.
- Edge firewall
- The firewall between the internal network and the internet; it sees forwarded traffic.
- Eradication
- Removing the attacker's presence: malware, accounts, persistence.
← TCP: the three-way handshake, flags and connection states · All lessons · Malicious systemd services →