how ccna certification

how ccna certification.rwtotal: Summarizes NetFlow records by the specified key attribute and prints the sum of the number of bytes, packets, and flow counts for flows matching that key attribute. rwtotal is faster than rwuniq, because the former uses quantitative memory, but it has a limited set of key attributes.rwaddrcount: Rounds NetFlow records by source or destination IPv4 address and prints the number of bytes, packets, and flow counts per IP.rwgroup: groups NetFlow records by user-specified key attributes (including record attributes), marks the records with the group ID stored in the next-hop IP field, and writes the final binary flow to a file or standard output.rwmatch: pairs records with queries and responses, marking them with the identifier stored in the next-hop IP field that has11.2 Network Insight Techniques 427paired records, writing binary flow records to the output. The ElasticsearchELK stack is a very powerful open source NetFlow analysis platform. As described earlier in this chapter, ELKstands for Elasticsearch, Logstash, and Kibana.4. Big data analysis of network insights related to cybersecurityNetFlow data, Syslog, SNMP logs, server and host logs, packet capture files, and other files (e.g., executables, malware, and exploiters) can be parsed and formatted, and then combined with threat intelligence information and other "precision data" (network metadata) to perform a comprehensive analysis. This analysis process is not simple, which is why Cisco has created an open source framework for big data analysis called OpenSecurityOperations Center (OpenSOC). OpenSOC was later replaced by Apache Metron (Incubating).Cisco created OpenSOC to curb the "big data problem" with its Advanced Threat Analytics (ATA) product (formerly known as ManagedThreatDefense (MTD)). . Cisco has developed comprehensive managed services (delivered by Cisco Security Solutions) to help customers defend against known intrusions, zero-day attacks, and advanced persistent threats. Cisco has a globally networked Security Operations Center (SOC) that ensures 24x7 attention to security issues and performs on-demand threat analysis. The SOC's security staff needs to be able to grab complete packet-level data and extract protocol metadata from it, create individual templates for customer networks, and monitor them against Cisco threat intelligence. You can imagine how difficult it is to do big data analysis on one unit, and Cisco needs to provide big data analysis services to many customers, including quite a few mega-enterprises. The goal of OpenSOC and today's ApacheMetron is to build a robust framework based on proven technology to detect today's security threats with a combination of machine learning algorithms and predictive analytics.