Make a denied east-west connection your best detection

applied · 70 min · Objective 2.4

Task

Apply objective 2.4: in a default-deny estate, turn the denials themselves into a detection, and show it has almost no false positive rate.

Steps

  1. Confirm denied connections are logged and reaching the collector. If they are not, fix that first -- a default-deny policy whose denials go nowhere has thrown away its best output.
  2. Write a detection rule that fires on a denied connection between two workloads with no declared relationship, and record it in lab/east-west-rule.md.
  3. Trigger it deliberately from a workload that should not reach another, and capture the alert in lab/east-west-alert.txt.
  4. Run the rule over a week of normal traffic and count the alerts. Record the false positive count in lab/east-west-fp.md with the cause of each.
  5. Compare against a content-inspection detection on the same traffic and write one paragraph on why the policy-based signal is cleaner.

Verify

grep -Eic 'deny|no declared relationship' lab/east-west-rule.md
test -s lab/east-west-alert.txt && echo "alert captured"
grep -Ec '[0-9]+' lab/east-west-fp.md
grep -Eci 'credential|legitimate|content|inspection' lab/east-west-fp.md

The rule written, a deliberate trigger captured, and a real false positive count. Lateral movement uses sanctioned protocols with valid credentials, so what distinguishes it is that the connection happened at all.

This is an independent study companion for CompTIA SecurityX CAS-005 and is not produced by or endorsed by CompTIA.