thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Intermediate

Network Traffic Analysis (NTA)

Monitoring and analyzing network traffic to detect anomalies, threats and performance issues.

Definition

NTA uses flow data, packet capture and protocol metadata to identify scanning, beaconing, lateral movement and exfiltration. It is the foundation of NDR products. Zeek is a common open-source tool producing rich protocol logs.

Example

Identifying a host communicating with Tor exit nodes from Zeek conn logs.

Exam tip

NTA complements endpoint telemetry for devices without agents.

Related terms