The Analyst's Toolkit: Which Tool Answers Which Question, From Wireshark to YARA
Chris Rees
25+ years in IT · Pluralsight author, 4.6/5 across 2,000+ ratings
www.skillthropic.comObjective 1.3 of CySA+ reads like a shopping list: Wireshark, tcpdump, Zeek, Snort, Suricata, a SIEM, EDR, a sandbox, Strings, VirusTotal, YARA, CyberChef, regular expressions. Candidates try to memorize what each one is and discover the exam never asks that. It asks which one you would use, given what you have and what you need to know. So sort the toolkit by question, not by name, and the objective becomes a single skill: matching the evidence you hold to the tool that can read it.
Tools are questions
Every tool in the objective answers one question well and several badly. A packet capture tells you exactly what crossed the wire and nothing about why the process sent it. An endpoint agent tells you what the process did and nothing about what the packets contained once they left. The exam's scenarios are built on that gap: they hand you a situation, describe what evidence exists, and ask for the tool that turns that evidence into an answer.
What crossed the network: capture versus summary
Wireshark and tcpdump are the same tool with different faces: full packet capture, every byte, decoded. tcpdump runs on the command line and is what you use on a server or a sensor where there is no desktop; Wireshark is what you open the resulting file in to follow a conversation, reassemble a download or read a cleartext credential. Full capture is definitive and expensive, which is why nobody stores it for long.
Zeek is different in kind, and the exam expects you to know why. It watches the same traffic but writes structured logs about it: every connection, every DNS query, every HTTP request, every TLS handshake, every file transferred, without storing the payload. The result is a fraction of the size of a capture and searchable for months. A stem asking which hosts talked to a suspicious domain over the past quarter is a Zeek (or flow) question; one asking what the payload of a specific session contained is a packet capture question.
The related distinction is PCAP versus EDR. A capture shows what left the machine; it cannot show which process sent it, what that process had read, or what it did next. EDR shows all of that and cannot show what the packets contained after they were encrypted. When a scenario has both available and asks which to use first, the answer depends on whether the question is about the host or about the wire.
Is it known bad: Snort and Suricata rules
Snort and Suricata apply rules to traffic and fire when one matches. The exam does not require you to write rules, but it does require you to read one, so know the anatomy: an action (alert, drop), a protocol, a source and destination with ports, a direction arrow, and then the options in brackets: a message, content to match, and a signature ID. A question that shows a rule and asks what it detects is asking you to read the content match and the ports. A question asking why a rule produces false positives is usually pointing at a content match that is too short or too common.
Placement follows the IDS versus IPS rule: on a tap it alerts, inline it can drop, and inline it can also break things.
What happened across many systems: the SIEM
The SIEM is where everything else's output lands. Its value is correlation: a failed login on one system, a successful one on another and a new scheduled task on a third are three logs until a rule connects them. The exam tests three things about SIEMs. Correlation rules connect events across sources over a time window. Queries let an analyst ask a question the rules did not anticipate, and knowing the query language of your platform is a stated skill. And tuning, which is the reason objective 1.5 exists: a SIEM with default rules produces noise, and the analyst's job is to adjust thresholds, suppress known-good patterns and enrich alerts until the queue is workable.
A stem about an alert that fires constantly for a legitimate backup job is a tuning question, not a detection question. A stem asking how to find every host that ran a particular command last month is a query question, and the tool is the SIEM, not the endpoint.
Is this file malicious: the analysis chain
The last row of the grid is a workflow rather than a set of alternatives, and the exam likes to test it in order.
VirusTotal is a reputation lookup: submit a hash and see what dozens of engines think. The trap the exam sets is that uploading the file itself shares it with the world, so for anything potentially confidential you hash locally and search by hash. A stem describing an analyst who uploaded a document containing customer data has described a data disclosure.
Strings extracts the human-readable text from a binary: hard-coded URLs, IP addresses, file paths, commands, error messages. It is free, instant and safe, and it is where you look before you run anything. CyberChef is what you use when the strings are encoded: base64, hex, XOR, compression, stacked together. The exam describes it as the tool for decoding obfuscated payloads and extracting indicators from them.
Sandboxing detonates the file in an isolated environment and records what it does: files written, registry changes, processes spawned, domains contacted. It is dynamic analysis, and it answers the question static analysis cannot: what will this actually do? Its limitation, which the exam knows, is that malware can detect the sandbox and behave, so a clean detonation is not proof of a clean file.
YARA turns what you learned into something reusable. A YARA rule describes a family by its strings and structure rather than by a hash, so it catches the next variant the attacker recompiles. The exam distinguishes it from a hash-based indicator for exactly that reason, and pairs it with EDR as the way to scan every endpoint for the rule.
Regular expressions are the glue: they extract indicators from logs, validate that a string looks like an IP or a hash, and feed the SIEM. Email analysis means reading headers, the received chain, the authentication results and the URLs behind the display text, which is where most incidents still begin.
The whole objective on one table
| Tool | Feed it | Get back | It cannot tell you |
|---|---|---|---|
| Wireshark, tcpdump | a capture or a live interface | every byte, decoded | what process sent it, or anything after encryption |
| Zeek | a live interface or a capture | structured logs per connection, query, file | the payload itself |
| Snort, Suricata | traffic plus a rule set | alerts, or dropped packets inline | anything without a rule |
| SIEM | logs from everything | correlated alerts, search, dashboards | what was never logged or never shipped |
| EDR, XDR | agent telemetry | process trees, file and registry activity, response actions | the contents of encrypted traffic |
| Sandbox | a suspicious file | observed behavior on detonation | what sandbox-aware malware chose not to do |
| Strings, CyberChef | a file or an encoded blob | readable text, decoded payloads | whether any of it is malicious |
| VirusTotal | a hash, a file, a URL or domain | multi-engine verdicts and history | anything nobody has seen before |
| YARA | a rule and a target | matches across files and memory | behavior; it matches content, not actions |
| Regex, email analysis | logs, headers, text | extracted indicators, the real sender and links | intent; it structures evidence, it does not judge it |
The last column is the one the exam builds distractors from. Every tool has a question it cannot answer, and the wrong answers are usually tools being offered for exactly that question.
One more habit worth carrying into the exam: enrichment. An indicator pulled out with regex, checked against VirusTotal and threat intelligence, and added to the SIEM as context is worth more than any single tool's output. Objective 1.5 calls this data enrichment, and it is the reason the toolkit is a chain rather than a menu.
Choosing under the exam's constraints
The scenarios add a constraint and expect you to respect it. If the stem says the analyst has no agent on the affected system, EDR is not available and the answer is network evidence. If it says the traffic is encrypted, packet capture shows you metadata only and Zeek's TLS logs or EDR become the answer. If it says the file must not leave the organization, VirusTotal by upload is wrong and hashing, Strings and an internal sandbox are right. If it says the same question needs to be asked across five hundred systems, the SIEM or a YARA scan through EDR is the answer, not Wireshark.
That is the whole method for objective 1.3: read the constraint, find the question, pick the row.
Key takeaways
- Sort tools by the question they answer. The stem tells you what evidence exists; the evidence tells you the tool.
- Full capture (Wireshark, tcpdump) is definitive and short-lived; Zeek keeps searchable summaries for months. PCAP shows the wire, EDR shows the process.
- Read a Snort or Suricata rule by its action, addresses, ports and content match. Too-short content matches cause false positives.
- The SIEM correlates across sources and answers questions with queries. Constant alerts on legitimate jobs are a tuning problem.
- File analysis runs static to dynamic: hash and reputation, Strings, sandbox, then a YARA rule to hunt with. Never upload confidential files to check them.
The toolkit is objective 1.3 of CySA+ Domain 1, Security Operations, 34% of the exam, and it is the equipment behind the triage judgment the rest of the domain tests. Work all 36 topics with our CySA+ Domain 1 study guide.
#CySA #CS0004 #SecurityOperations #Wireshark #Zeek #Suricata #SIEM #EDR #YARA #BlueTeam #CompTIA #CyberSecurity
Keep reading
Feeds, Confidence, and the Pyramid of Pain: Threat Intelligence and Threat Hunting the Way CySA+ Tests Them
A sharing group sends a report with no hash to block and no signature to deploy, only a description of how the adversary works. Turning that into detection is CySA+ objective 1.4. Threat actor types, where intelligence comes from and how much of it to believe, the intelligence cycle, STIX and TAXII, the Pyramid of Pain, and why a threat hunt starts from the opposite assumption to a monitoring rule.
Read CySA+ deep divesCVSS, EPSS and KEV: Cutting 61,000 Findings Down to This Week's Work
Severity is not priority. What CVSS actually measures and the two metric groups almost nobody applies, how EPSS turns severity into probability, why the CISA KEV catalog ends most arguments, and a prioritization funnel that survives contact with a real vulnerability queue. CySA+ CS0-004 Domain 2.
Read CySA+ deep divesSOC Triage: Turning 40,000 Alerts Into the Handful That Matter
Security Operations is 34% of CySA+ CS0-004, and almost all of it is triage. How telemetry becomes an alert, what the true/false positive quadrant costs you, why the Pyramid of Pain decides which indicators are worth detecting, when to hunt instead of wait, and where AI helps in a SOC without being trusted.
ReadEnjoyed this? Get the AI security news that matters.
Join The AI Security Brief for the top AI security news, plus what's important to the C-suite. Free, straight to your inbox.
No spam. Unsubscribe anytime.
This is a third of your exam
Security Operations is the largest domain on CySA+ CS0-004 by some distance. Master all 36 topics across six objectives, including 1.6, AI in security operations, with a running SOC scenario and 120 practice questions.
Get the CySA+ Domain 1 guide