1.3.2. The Analyst's Toolkit: Data Sources
💡 First Principle: Every detection capability is only as good as its data sources — an analyst without visibility into a segment of the network cannot detect threats there, regardless of how good their tools and skills are.
Visibility gaps are the adversary's best friend. If your SIEM doesn't collect endpoint logs, you can't detect process injection. If you don't collect DNS logs, you miss C2 over DNS tunneling. If you don't log authentication events from cloud apps, you can't detect compromised credentials being used to access SaaS data.
The key data sources a CySA+ analyst works with:
| Data Source | What It Captures | Primary Use Case |
|---|---|---|
| Network logs (NetFlow, PCAP) | Traffic patterns and connections (NetFlow: flow metadata only; PCAP: full packets including payloads) | Detecting beaconing, lateral movement, exfiltration |
| Endpoint logs (Sysmon, Windows Event) | Process creation, file changes, registry mods | Detecting malware execution, persistence |
| Authentication logs (AD, SSO) | Login attempts, privilege use, MFA events | Detecting credential attacks, impossible travel |
| DNS logs | Domain lookups, resolution patterns | Detecting C2 channels, phishing domains |
| Application logs | User actions, API calls, errors | Detecting data access anomalies, injection attempts |
| Email headers/logs | Sender info, routing, SPF/DKIM/DMARC results | Detecting phishing, spoofing |
| Cloud audit logs | API calls, resource changes, identity events | Detecting cloud misconfigurations, data access |
The exam tests your ability to pick the right data source for a given detection scenario. If someone asks "which log would show unauthorized scheduled task creation," the answer is Windows Event logs (specifically Event ID 4698). If someone asks about beaconing, the answer is network traffic logs or SIEM correlation.
⚠️ Exam Trap: Having a SIEM doesn't mean you have full visibility — it only aggregates the logs you've configured it to collect. Missing log sources = missing detections. "We have a SIEM" is not the same as "we have complete visibility."
Reflection Question: An attacker uses DNS tunneling to exfiltrate data — each request carries a small amount of data encoded in the subdomain field. Which data source would help detect this, and what pattern would you look for?
