A SIEM dashboard shows outbound traffic from the finance network at three times its usual Tuesday-night level. That chart is where the investigation starts, not where it ends. To say which host sent the data, where it went, what it contained and who was sitting at the keyboard, you need flow records, packet captures, endpoint alerts and, eventually, a camera.
On the CompTIA Security+ SY0-801 exam this sits under objective 4.8, which expects you to choose the evidence that can answer an investigator's question in a given scenario. This lesson covers the data sources the objective names beyond the logs themselves: vulnerability scans, automated reports, NetFlow and IPFIX, surveillance footage, security tools, dashboards and packet captures. Deploying these tools for everyday monitoring belongs to the monitoring section; here the focus is what each one proves after something has gone wrong.
Data sources differ in how much detail they keep and how far back they reach
Every source trades detail against reach. A packet capture keeps everything that crossed the wire, so it fills disks in hours or days. A flow record keeps a few dozen bytes per conversation, so months of history fit easily. Dashboards and reports keep less still, because they are summaries. Knowing that trade-off tells you which source to ask before you open any of them.
| Source | What it holds | Typical reach back | What it proves |
|---|---|---|---|
| Packet capture | Full packets, payload included | Hours to days | Exactly what was sent |
| NetFlow or IPFIX | Addresses, ports, times, byte counts | Weeks to months | Volume, timing, direction |
| Vulnerability scans | Weaknesses found at scan time | Each scan cycle | What was exposed |
| Automated reports | Scheduled summaries | As long as kept | Trends and baselines |
| Security tools | Alerts with context | Varies by tool | That a detection fired, and why |
| Dashboards | Live aggregated views | The current window | Where to look next |
| Surveillance footage | Video of physical spaces | Often days to weeks before overwrite | Who was physically present |
Retention periods vary widely by organization and product, so treat that column as typical, not standard. On the exam the pattern usually holds: a question about content points to packets, a question about volume or long-term patterns points to flows, and a question about a person in a place points to footage.
NetFlow and IPFIX record who talked to whom and how much, without the content
A flow is a set of packets that share the same key fields: source and destination address, source and destination port, and protocol, plus a few more such as the interface. A router, firewall or dedicated probe (the exporter) tracks each flow and sends a summary record to a collector when the flow ends or times out. The record holds the key fields, start and end times, packet and byte counts, and TCP flags. It holds no payload.
NetFlow is Cisco's format. Version 5 has fixed fields and supports only IPv4; version 9 uses templates, so it can describe IPv6 and new fields. IPFIX is the IETF standard built from version 9, sometimes called version 10, and its registered port is 4739. On the exam, NetFlow and IPFIX play the same role. Flow records are usually one-directional, so a single conversation produces two records, and long transfers are often split into several records at the exporter's active timeout (commonly 30 minutes on Cisco gear), which you add back together.
Here is what a collector shows for the dashboard spike:
Date first seen Duration Proto Src IP Addr:Port Dst IP Addr:Port Packets Bytes
2026-10-14 03:41:07.215 1781.302 TCP 10.1.20.45:51602 -> 198.51.100.23:443 1.31 M 1.8 G
2026-10-14 03:41:07.218 1781.299 TCP 198.51.100.23:443 -> 10.1.20.45:51602 402 K 21.4 M
2026-10-14 03:41:40.120 0.811 TCP 10.20.4.31:50210 -> 203.0.113.15:443 38 9.1 K
2026-10-14 03:41:40.123 0.809 TCP 203.0.113.15:443 -> 10.20.4.31:50210 61 74.2 K
The second pair is ordinary browsing: a small request out, a larger page back. The first pair is inverted. Workstation 10.1.20.45 sent 1.8 GB to one external host in under 30 minutes and got 21 MB back, almost all of it acknowledgments. Sending far more than it receives to a single destination, especially at 3 a.m., is the classic flow signature of exfiltration. Flows also expose beaconing: a host making near-identical small connections to the same address every 60 seconds for days is checking in with a command-and-control server.
This was the second upload. The log types lesson traced a 1.9 GB transfer at 03:05 through the web proxy; once the proxy blocked the destination, the sync tool connected directly, and the firewall still allowed outbound 443 from the finance network. That gap is a finding in its own right.
Know what flows can't do. They don't show which files were sent or which user started the transfer. Many exporters sample, recording one packet in 100 or 1,000, so byte counts become estimates and very short flows can be missed entirely.