Network security monitoring (NSM) means collecting and analyzing network data to detect threats. This is Module 10 of The Complete Blue Team Course.
Why Network Visibility Still Matters
Even with strong endpoint visibility, network monitoring catches things endpoints miss: lateral movement between systems without EDR, command-and-control patterns, and activity from unmanaged or IoT devices that cannot run an agent at all.
Reading Traffic with Wireshark and Zeek
- Wireshark: ideal for deep, manual packet-level investigation of a specific incident.
- Zeek: works at scale, producing structured logs of network activity across an entire environment continuously.
Most mature programs use both, for different purposes.
Encrypted Traffic and Its Limits
Most traffic today is encrypted, which limits deep packet inspection but does not blind you. Metadata such as connection patterns, timing, volume, and destination reputation, plus techniques like JA3/JA3S TLS fingerprinting, still reveal a great deal without decrypting any payload.
What to Look For
- Regular, timed outbound connections (beaconing).
- Large unexpected data transfers to external hosts.
- Unusual DNS activity.
- Internal-to-internal connections that should not exist.
Key Takeaways
- Network data complements endpoint data.
- Wireshark for deep dives, Zeek for continuous visibility.
- Metadata is valuable even when traffic is encrypted.
Frequently Asked Questions
Is Wireshark free?
Yes, Wireshark is free and open source.
Can I detect attacks in encrypted traffic?
Often yes, through metadata and behavior patterns, even without reading the content.
Get the Full Blue Team Course
This is a free preview of Module 10. The complete 22-module course, from SOC fundamentals and SIEM to threat hunting, incident response, detection engineering, and career paths, is available as a one-time $1 download.