A threat actor penetrated an organization's network. Using the 5-tuple approach, which data points should the analyst use to isolate the compromised host in a grouped set of logs?

The 5-tuple is a standard, fundamental concept in TCP/IP networking used to uniquely identify a communication session or "flow" between two endpoints. It consists of five specific data points from the packet headers: the protocol (e.g., TCP, UDP), the source IP address, the source port number, the destination IP address, and the destination port number. When analyzing network logs, such as NetFlow data, security analysts use this exact combination to isolate and track specific conversations. This allows them to distinguish a malicious actor's traffic from all other legitimate network activity and trace it to the compromised host.

A: This option includes non-standard 5-tuple elements like "event name" and "log source," which describe the log entry itself, not the network flow.

C: This option is more representative of an authentication or application event log, lacking essential network identifiers like protocol and port numbers.

D: This option incorrectly replaces the critical source and destination port numbers with "log source" and "host name," which are not part of the 5-tuple definition.

1. Official Vendor Documentation: Santos

O. (2020). Cisco CyberOps Associate CBROPS 200-201 Official Cert Guide. Cisco Press. In Chapter 13

"Network Intrusion Analysis

" the section on NetFlow explicitly defines a network flow as a unidirectional sequence of packets that share the following five values: source IP address

destination IP address

source port

destination port

and Layer 3 protocol type. This collection of values is commonly referred to as the 5-tuple.

2. University Courseware: Kurose

J. F.

& Ross

K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson. In Chapter 3

"Transport Layer

" Section 3.2

"Multiplexing and Demultiplexing

" the text explains that a TCP socket is identified by a four-tuple (source IP

source port

destination IP

destination port). The addition of the protocol field (e.g.

TCP or UDP) completes the 5-tuple that uniquely identifies the session.

3. Peer-reviewed Academic Publications: Estan

C.

& Varghese

G. (2003). New directions in traffic measurement and accounting. In Proceedings of the 2003 conference on Applications

technologies

architectures

and protocols for computer communications (pp. 323-336). ACM. DOI: https://doi.org/10.1145/863955.863998. This foundational paper on network traffic analysis discusses flows

which are traditionally defined by the 5-tuple (source/destination addresses

source/destination ports

and protocol).