> For the complete documentation index, see [llms.txt](https://cybrhawksoc.gitbook.io/cybrhawk-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cybrhawksoc.gitbook.io/cybrhawk-docs/soc-analyst-guide/everyday-tasks/investigate-network-intrusions.md).

# Analyze Network Intrusions

**Dashboard Location:**\
Main Menu → **Network → Network Intrusions**

The **Network Intrusions** dashboard provides visibility into inbound and internal traffic patterns, helping analysts identify suspicious behavior, intrusion attempts, and plain-text credential exposures. It allows security teams to pivot quickly between external attacks, internal traffic anomalies, and targeted investigations, giving complete visibility into attacker behaviors across the perimeter and inside the network.

***

### Identifying Attackers Targeting the Internet Perimeter

1. Open the **Network Intrusions** dashboard.
2. In the **Network Direction** pie chart, select **External Traffic**.
3. Review the **Destination Port Table** to see the number of unique attackers per port.
4. Click on a specific port to drill down into:
   * Attack origins
   * Top attacking hosts
   * Techniques used

> **Tip:** Pay close attention to privileged ports (e.g., SSH, RDP). If the traffic is expected, consider whitelisting to reduce false positives.

***

### Detecting Plain-Text Credentials on Internal Traffic

1. Open the **Network Intrusions** dashboard.
2. In the **Network Direction** pie chart, select **Inside Traffic**.
3. Use the **Destination Port Table** to identify protocols transmitting credentials in plain text.
4. Drill into a port to analyze:
   * Attack origin
   * Top attacking sources
   * Associated techniques

> **Note:** Protocols like FTP and Telnet are especially prone to transmitting credentials without encryption.

***

### Tracing Intrusions from a Specific Source IP

1. Open the **Network Intrusions** dashboard.
2. Enter a search query in the search bar, for example:

```
source.ip:192.168.10.10
```

This will filter the dashboard to display all intrusion attempts originating from that IP.