Unit 1: Layers and packets · Lesson 5 of 5 · 22 min
Case file: the sensor that went quiet
A traffic inspection sensor stops seeing anything for two weeks and nobody notices. Find it, find why, and make silence an alert.
case file
Equifax Breach
Equifax · 2017
Attackers exploited a publicly disclosed Apache Struts vulnerability in Equifax's internet-facing online dispute portal and stayed for months, exposing personal data of roughly 147 million people. The intrusion was spotted only after Equifax renewed an expired certificate on a traffic-inspection device, which immediately revealed suspicious traffic. Equifax later agreed to a global settlement of up to $425 million with the FTC, CFPB and US states.
What went wrong
The March 2017 Struts patch was not applied to the dispute portal (a follow-up scan missed the vulnerable system), and the device that inspected the portal's network traffic had been inactive for about 19 months because its certificate had expired.
What would have stopped it
- Maintain an accurate asset and software-component inventory so every internet-facing instance of a vulnerable library is found and patched, then verify the patch rather than relying on a single scan.
- Track expiry of certificates used by security tooling (TLS inspection, IDS) and alert well before expiry; treat a silent monitoring device as an incident.
- Segment sensitive databases from internet-facing applications and restrict which credentials the web tier can use.
What defenders could have seen
- Health/heartbeat alert when a network inspection sensor stops producing events.
- Vulnerability scan or SBOM match showing the vulnerable Struts version on a public host after the patch deadline.
- Unusual outbound data volumes or database queries originating from the dispute portal servers.
sourcestechtarget.comgao.govftc.gov
mission
- You are
- The analyst who owns network sensor health at corp.example.
- Situation
- corp.example decrypts and inspects traffic to its customer portal, the same design Equifax used. Each sensor reports a daily event count to
~/sensors/heartbeat.csv. This lab is modelled on the Equifax case. - Goal
- Find any sensor that stopped producing events, work out why, and propose the alert that would have caught it.
- Hand in
- The silent sensor, the day it went quiet, the cause and the alert rule.
A watchtower whose lamp went out
Read what each sensor watches
Every sensor exists because someone decided that traffic mattered. Note which ones would raise an alarm if they went quiet.
cat sensors.txt
sensor watches alert if silent
ids-dmz DMZ switch span port no
ids-core core switch span port no
netflow-edge edge router flow export no
tls-inspect-portal decrypted traffic to portal01 no
you should see Four sensors, and none of them alerts when it goes silent.
Look at today's counts
A healthy sensor never reports zero on a working day. Start with the most recent rows.
tail -n 4 heartbeat.csv
2026-10-14,ids-dmz,46617
2026-10-14,ids-core,120929
2026-10-14,netflow-edge,2205309
2026-10-14,tls-inspect-portal,0
you should see One sensor reported zero events today.
Find every zero
One zero could be a quiet day. A run of zeros is a blind spot.
awk -F, '$3==0' heartbeat.csv | head -n 3 2026-09-30,tls-inspect-portal,0 2026-10-01,tls-inspect-portal,0 2026-10-02,tls-inspect-portal,0 awk -F, '$3==0 {n++} END {print n}' heartbeat.csv 15 awk -F, '$2=="tls-inspect-portal" && $3>0 {last=$1} END {print last}' heartbeat.csv 2026-09-29
you should see tls-inspect-portal has reported nothing for 15 days. Its last real day was 29 September.
Check the sensor's certificate
An inspection sensor needs a valid certificate to decrypt traffic. When it expires, many products stop inspecting without any error a human would see.
openssl x509 -in certs/tls-inspect-portal.pem -noout -subject -enddate subject=CN = tls-inspect-portal.corp.example, O = corp.example notAfter=Sep 30 00:00:00 2026 GMT openssl x509 -in certs/tls-inspect-portal.pem -noout -checkend 0 Certificate will expire
you should see The certificate expired at midnight on 30 September, the same day the counts dropped to zero.
defender tip -checkend N asks whether the certificate expires within N seconds. Use -checkend 2592000 in a daily job to warn 30 days ahead.
Check the other sensors the same way
If one certificate was forgotten, check the rest before you close the finding.
for f in certs/*.pem; do echo "$f $(openssl x509 -in $f -noout -enddate)"; done
certs/ids-dmz.pem notAfter=Jun 30 00:00:00 2030 GMT
certs/netflow-edge.pem notAfter=Jan 10 00:00:00 2030 GMT
certs/tls-inspect-portal.pem notAfter=Sep 30 00:00:00 2026 GMT
you should see The other two are valid until 2030.
Sensor monitoring, before and after
sensor alert if silent tls-inspect-portal no certificate expiry not tracked
The portal was unwatched for 15 days and nobody knew.
alert: any sensor with 0 events for 1 day alert: sensor certificate expires within 30 days owner: network team, reviewed weekly
Silence is treated as an incident, and the cause is caught a month early.
What a defender takes away
- 1A security tool that stops working fails silently unless you watch its heartbeat.
- 2Certificates inside security tools expire too; track them like any other.
- 3Alert on zero events, not just on bad events.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.