30 Days of CyberHer Africa: Week 3-NetworkMiner, Wireshark and Wazuh for SOC Investigations

As part of the 30 Days of CyberHer Africa Challenge, here's the Week 3 documentation. We explored SSH brute-force detection, an end-to-end SOC investigation that connects network packets and system logs to a verified security incident.

Imagine receiving an alert at 04:12 AM that someone is repeatedly attempting to log in to a server hosting a small clinic's booking portal. As a Tier 1 SOC analyst, your job isn't just to look at the alert and immediately conclude the server is under attack. You need to investigate and understand what is happening.

Some of the questions you should be able to answer include:

• Who is attacking? Identify the source IP address and the account being targeted.
• What are they trying to do? Determine whether the activity looks like a brute-force attempt to guess login credentials.
• Did they get in? Check the logs for successful logins and determine whether the attacker may have gained access.
• What did they do next? Look for suspicious activity after the login, such as unusual commands or other changes on the system.
• Is it a genuine incident or a false alarm? Compare the alert with the available evidence to determine whether it represents a real threat or legitimate activity that triggered an alert.

This is what makes SOC investigation interesting. An alert is only the starting point. We need evidence before deciding what happened and how serious it is.

Now, let's dive into the practical side!

1. What's NetworkMiner?

NetworkMiner is a network forensic analysis tool that helps analysts investigate captured network traffic and identify useful information from it. Instead of examining every packet individually, it can automatically organize information into artifacts such as hosts, network sessions, DNS queries, and files found in the traffic.

It can also help identify devices communicating on a network by building a host inventory from the captured traffic. This is useful for passive asset discovery and understanding which systems are communicating with one another. NetworkMiner can also sniff live traffic from a network interface, depending on the operating system, permissions and configuration.

Although NetworkMiner is primarily designed for Windows, it can also be used on Linux. For this exercise, I downloaded and set it up on Kali Linux, where I will be using it to analyze a PCAP file.

How to install NetworkMiner on Kali Linux

Here are the steps I followed to get NetworkMiner running on Linux.

Step 1: Install the required dependencies

Open the terminal and update the package list:

sudo apt update

sudo apt update

Install the required packages:

sudo apt install mono-devel libgtk2.0-common unzip curl -y

sudo apt install mono-devel libgtk2.0-common unzip curl -y

Mono allows certain .NET applications to run on Linux. The GTK libraries may be needed for the graphical interface, while unzip and curl help with downloading and extracting the application.

Note: Dependencies can vary depending on your Kali Linux version. If you encounter a missing-library error, check the current NetworkMiner documentation for the requirements.

Step 2: Download NetworkMiner

Run the following command in the terminal:

curl -L -o /tmp/NetworkMiner.zip "https://www.netresec.com/?download=NetworkMiner"

curl -L -o /tmp/NetworkMiner.zip "https://www.netresec.com/?download=NetworkMiner"

This downloads the NetworkMiner ZIP archive into the /tmp directory.

Step 3: Extract the downloaded file

Run:

sudo unzip /tmp/NetworkMiner.zip -d /opt/

sudo unzip /tmp/NetworkMiner.zip -d /opt/

The /opt/ directory is commonly used to store additional applications.

To check the extracted directory, run:

ls /opt/ | grep NetworkMiner

ls /opt/ | grep NetworkMiner

Step 4: Start NetworkMiner

Move into the NetworkMiner directory. If the extracted folder is named NetworkMiner, run:

cd /opt/NetworkMiner

cd /opt/NetworkMiner

Then launch the application:

mono NetworkMiner.exe

mono NetworkMiner.exe

If NetworkMiner opens successfully, you're ready to start analyzing a capture file.

If you encounter a launch error, check the extracted folder name and any missing dependencies. The exact requirements may vary by version.

Loading a PCAP file in NetworkMiner

A PCAP file contains captured network packets that can be examined later. PCAP files are useful in network investigations because analysts can review traffic without needing to capture it live.

Once NetworkMiner opens:

1. Go to File — Open.
2. Browse to the folder containing your PCAP file.
3. Select the capture file and open it.
4. Give NetworkMiner time to process the traffic.
5. Explore the different tabs to understand what the capture contains.

For my exercise, I used a PCAP file in Kali Linux and explored the information NetworkMiner extracted from it.

Exploring the NetworkMiner tabs

After loading a PCAP file, you will notice several tabs. Each presents a different view of the captured network traffic.

• Hosts: Identifies devices seen in the traffic, including their IP addresses and other available host information.
• Sessions: Shows network conversations between hosts, including the communicating IP addresses, ports and protocols.
• DNS: Displays DNS queries and related domain names found in the capture.
• Files: Lists files that NetworkMiner can identify or reconstruct from supported network traffic.
• Credentials: May display credentials exposed through supported protocols when they are present in the capture. Encrypted traffic generally limits what can be recovered.
• Images and other artifact tabs: Depending on the version and the capture, NetworkMiner may identify images and other useful artifacts.

These tabs make it easier to get an overview of what happened on a network. For example, the Hosts tab can help identify the systems involved, while Sessions and DNS can provide clues about the connections they made. However, seeing a domain, file, or connection does not automatically mean something malicious happened. The findings still need to be investigated in context.

2. NetworkMiner vs. Wireshark

Now, let's look at the difference between NetworkMiner and Wireshark.

NetworkMiner is a Network Forensic Analysis Tool (NFAT), while Wireshark is a network protocol analyzer. Both tools can work with captured network traffic, but they present and analyze the information differently.

NetworkMiner automatically organizes much of the captured data into useful views, such as hosts, sessions, DNS requests and files. This makes it convenient when you want to quickly understand which systems were communicating and identify artifacts that may be relevant to an investigation.

Wireshark, on the other hand, allows you to examine packets in much greater detail. You can inspect protocol fields, follow conversations, apply display filters and investigate the exact contents of individual packets where the traffic allows it.

For example, if I want to identify the hosts communicating in a PCAP file, NetworkMiner can provide a convenient overview. If I want to investigate a specific connection more closely, inspect the protocol details or filter for particular packets, Wireshark is very useful.

Both tools can help answer similar investigation questions, but they approach them differently.

• NetworkMiner: Useful for quickly organizing traffic into hosts, sessions and other forensic artifacts.
• Wireshark: Useful for detailed packet inspection, protocol analysis and targeted investigation using filters.

I see these tools as complementary rather than competitors. NetworkMiner can help me understand what is in a capture, while Wireshark can help me dig deeper into the packets and investigate specific findings.

3. Understanding Wazuh SIEM

After exploring network traffic, we also looked at Wazuh. Wazuh is an open-source security platform that provides capabilities such as security monitoring, log analysis, threat detection, file integrity monitoring and security configuration assessment. It can collect and analyze events from monitored endpoints and generate alerts when activity matches configured detection rules.

A Security Information and Event Management (SIEM) system helps security teams bring together security-related events, analyze them and identify activity that may require investigation. For a SOC analyst, this is important because security information can come from different sources. A network capture may show communication between systems, while endpoint logs may show login attempts, account activity or changes made on a machine. Examining these sources together can provide a clearer picture of an incident.

Exploring the Wazuh dashboard

I then explored the Wazuh dashboard and used Threat Hunting to view and investigate security events.

Here are some of the areas that are useful to understand when navigating Wazuh:

• Threat Hunting: Allows analysts to search and examine collected security events and alerts. Search queries and time filters help narrow down the activity being investigated.
• Security Events / Alerts: Depending on the dashboard version and selected view, these show events that have matched detection rules or otherwise been identified as relevant to security monitoring.
• Agents: Shows the endpoints connected to Wazuh, along with information about their status and configuration. This helps an analyst check which machines are being monitored.
• Vulnerability Detection: Helps identify known vulnerabilities associated with monitored systems and installed software, where the required inventory data is available.
• Integrity Monitoring: Monitors selected files and system changes that could indicate unauthorized or suspicious modifications.
• Security Configuration Assessment (SCA): Checks systems against defined security configuration policies and highlights potential weaknesses.
• Dashboard and visualizations: Help analysts review trends, event counts and other summaries of the data collected.

The exact menus and labels may vary depending on the Wazuh version and dashboard configuration. While exploring Threat Hunting, I learned that filtering is important. A dashboard can contain a large number of events, and searching through everything without a clear focus can make an investigation difficult.

For example, when investigating suspected SSH brute-force activity, I would narrow the time range to the period of interest and search for relevant authentication events. I would then look for repeated failed login attempts, identify the source IP and targeted account, and check whether a successful login occurred afterwards.

I would also compare the timestamps and other available evidence rather than relying on a single alert. A high number of failed logins may indicate brute-force activity, but the investigation should establish what happened and whether the activity was successful. This is where the different tools begin to make sense together. NetworkMiner and Wireshark help investigate captured network traffic, while Wazuh helps analyze security events and logs from monitored systems.

The goal is not just to collect alerts or open tools. It is to use the available evidence to understand what happened.

4. Lessons learnt

Week 3 helped me understand how different tools can support a SOC investigation.

Some of the key lessons I took away include:

1. An alert is the beginning of an investigation, not the conclusion. It is important to validate what triggered it and determine whether there is evidence of a genuine incident.
2. Network traffic provides useful evidence. PCAP files allow analysts to review communication between systems and investigate suspicious connections.
3. Different tools serve different purposes. NetworkMiner helps organize network artifacts, Wireshark supports detailed packet analysis, and Wazuh helps monitor and investigate security events.
4. Time filters and search queries matter. Narrowing down the relevant period and searching for specific events makes log analysis more manageable.
5. Evidence should be correlated. Combining network information with endpoint logs can help establish what happened, whether access was successful and what may have followed.

I am still learning, and every practical exercise gives me a better understanding of how SOC analysts approach investigations. The more I work with these tools, the more I appreciate the importance of patience, attention to detail and following the evidence.

Conclusion

Week 3 was about moving beyond simply learning cybersecurity concepts and getting more comfortable with the tools used during investigations. From installing NetworkMiner on Kali Linux and exploring a PCAP file to navigating Wazuh Threat Hunting, I got to see how network traffic and security logs can support an investigation.

There is still more to learn, but I am gradually building my understanding of the SOC workflow, one practical exercise at a time.

Stay tuned for Week 4, the final week of the 30 Days of CyberHer Africa Challenge! Let's see what else we can learn and put into practice.