Scenarios & Selection

The Internet egress point is the highest-priority observation location in any enterprise network. All outbound traffic — including C2 beaconing, data exfiltration, DNS tunneling, and unauthorized cloud service access — must traverse this boundary. This scenario deploys TAP-based packet sensors at each egress link combined with NetFlow/IPFIX collection from border routers and firewalls. TLS fingerprinting (JA3/JA4) is applied to detect malicious client fingerprints even when payload is encrypted. DNS analytics identify tunneling, DGA domains, and suspicious resolution patterns. Behavioral baselines track per-destination bandwidth, connection frequency, and session duration to detect slow exfiltration that evades threshold-based rules.

East-west traffic within data centers represents the primary attack surface for lateral movement, credential harvesting, and ransomware propagation. Traditional perimeter-focused monitoring is blind to these threats. This scenario deploys NetFlow/IPFIX exporters on top-of-rack switches and core fabric switches, combined with selective SPAN mirroring to packet sensors at aggregation points. The detection focus is on SMB/RDP lateral movement patterns, unusual port scanning between servers, unexpected protocol usage, and connections from compromised workloads to sensitive data tiers. Microsegmentation zone mapping provides context for evaluating whether observed connections are expected or anomalous based on the defined communication matrix.

The DMZ hosts externally accessible services including web applications, reverse proxies, API gateways, and mail relays. This zone is both the most exposed and the most critical to monitor with packet-level visibility because attackers frequently use DMZ servers as initial footholds before pivoting inward. This scenario deploys full packet capture sensors on DMZ segments to enable TLS certificate anomaly detection, HTTP request pattern analysis, and DNS query monitoring. WAF log integration provides application-layer context. The primary detection goals are web shell activity, reverse shell beaconing from compromised web servers, unauthorized outbound connections from DMZ hosts, and TLS certificate mismatches indicating man-in-the-middle activity.

The convergence of operational technology (OT) and information technology (IT) networks creates a high-risk boundary where industrial protocols (Modbus, DNP3, EtherNet/IP, PROFINET) meet standard IP networking. This scenario focuses passive monitoring on the IT/OT boundary using TAP-based packet sensors that can decode industrial protocols without injecting any traffic into the OT network. The Purdue Model zone structure defines expected communication patterns, and any deviation — such as IT hosts communicating directly with Level 0-1 OT devices, or OT devices initiating outbound Internet connections — triggers high-priority alerts. Protocol whitelisting enforces that only expected industrial protocols appear on OT segments.

Branch sites present a unique monitoring challenge: they have limited bandwidth and compute resources, yet they are frequently targeted as entry points because their security posture is typically weaker than headquarters. This scenario uses a flow-first approach — leveraging NetFlow/IPFIX exports from SD-WAN appliances and branch routers — augmented by DNS log forwarding from branch DNS resolvers. Full packet capture is not deployed at branches due to bandwidth and cost constraints. Instead, selective PCAP is triggered remotely at headquarters-side sensors when branch anomalies are detected. The detection focus is on unusual outbound destinations, DNS tunneling, and credential theft patterns that indicate a compromised branch endpoint.

Hybrid cloud environments combine on-premises data centers with one or more public cloud platforms, creating complex traffic flows that span multiple administrative domains. This scenario integrates cloud-native telemetry — VPC Flow Logs (AWS/Azure/GCP), CloudTrail/Activity Log API events, and DNS resolver logs — with on-premises flow and metadata collection into a unified analytics platform. The detection focus is on unusual cloud egress patterns indicating data exfiltration, unauthorized cross-cloud traffic flows, API abuse patterns, and privilege escalation events in cloud identity systems. Cloud workload identity mapping is critical for correlating network events with cloud IAM identities.

Financial institutions face a unique combination of high-value targets, strict regulatory requirements (PCI-DSS, SOX, DORA), and sophisticated adversaries including nation-state actors and organized cybercrime groups. This scenario deploys comprehensive monitoring across payment processing networks, SWIFT messaging infrastructure, trading systems, and customer-facing banking platforms. Behavioral analytics focus on insider threat detection — unusual access patterns to financial data, anomalous transaction volumes, and after-hours administrative activity. SWIFT network monitoring detects fraudulent message injection patterns. The compliance requirement for immutable audit logging and 7-year retention drives specific storage architecture decisions.

Healthcare networks combine clinical IoT devices (infusion pumps, imaging systems, patient monitors), electronic health record (EHR) systems, and administrative IT infrastructure on a shared network fabric. This creates a complex monitoring challenge where patient safety depends on network availability and data integrity. This scenario uses passive-only monitoring to avoid any risk of disrupting medical devices. NetFlow collection from clinical network switches identifies unusual device communication patterns. DNS monitoring detects ransomware C2 callbacks — a critical early warning given the devastating impact of ransomware on healthcare operations. HIPAA compliance requirements drive strict access controls and audit logging for all patient data-adjacent telemetry.