🔎 Raqamli detektiv bo'lishga tayyormisiz?

Log fayllar, ogohlantirishlar, tahdid ma'lumotlari — bularni bir-biriga bog'lab, hujumni zarar yetkazmasdan oldin aniqlash... Bu oddiy ish emas, bu san'at!
Cybersecurity Defense Analyst yo'nalishining 6-kursi — haqiqiy tergovchi ko'nikmalari! 👇

📖 Kursda nima o'rganasiz?
✅ Professional analistlar qo'llaydigan 5 bosqichli tergov tizimi
✅ CIM maydonlari yordamida xavfsizlik hodisalarini aniqlash va tahlil qilish
✅ Hodisalarni tasniflash va qaror qabul qilish
✅ 3 ta haqiqiy stsenariy orqali murakkab tergov olib borish
✅ Ichki tahdidlarni ovlash, shubhali IP manzillarni kuzatish va domain kontrollerga hujumlarni tekshirish

🎬 Bu kursning o'ziga xosligi?
Siz faqat o'qimaysiz — tajribali analist bilan "yelkama-yelka" ishlaysiz!
Hayajonli "ride-along" tajribalari orqali haqiqiy hodisalarni qanday tekshirishni ko'rasiz va o'zingiz sinab ko'rasiz.

🔗 Bepul ro'yxatdan o'ting:
👉 https://www.netacad.com/courses/splunk-the-art-of-investigation?courseLang=en-US&instance_id=44928af9-2a91-4e1d-9285-b4e8eb318898

💡 Har bir log — bir iz. Har bir iz — javobga bir qadam yaqinroq!

@cisco_server

#Kiberxavfsizlik #SOC #Tergov #Splunk #BepulKurs #NetAcad #DigitalDetektiv

🏰 Wonderland SOC ga xush kelibsiz — bu yerda haqiqiy analistlar tarbiyalanadi!
Ogohlantirishni ko'rish — oson. Uni tushunish, tahlil qilish va zararsizlantirish — bu mahorat!
Cybersecurity Defense Analyst yo'nalishining 7-kursi — Splunk bilan professional tergov! 👇

📖 Kursda nima o'rganasiz?
✅ Tahdidni aniqlash — Splunk ES dashboard va funksiyalari yordamida ogohlantirishdan yakuniy qarorga qadar tergov olib borish
✅ Xavfni baholash — Splunk'ning risk-based alerting tizimi orqali qaysi hodisaga birinchi navbatda e'tibor berish kerakligini aniqlash
✅ Splunk ES Freymvorklari — Asset & Identity va Threat Intelligence vositalari bilan tahlilni boyitish
✅ Avtomatlashtirish — Splunk SOAR playbook'lari yordamida javob amallarini avtomatlashtirish va samaradorlikni oshirish

🎯 Nima uchun bu kurs?
Haqiqiy SOC analistlari ishlatadigan xuddi shu asboblar bilan mashq qilasiz. Tajribali mutaxassislar eng yaxshi usullarni bevosita sizga o'rgatadi!

🔗 Bepul ro'yxatdan o'ting:
👉 https://www.netacad.com/courses/soc-essentials-investigating-with-splunk?courseLang=en-US&instance_id=0d568709-a946-4441-b033-4ba50433c613

💡 Professional analistlar ham bir vaqtlar shu yo'ldan boshlagan.Endi sizning navbatingiz!

@cisco_server

#Splunk #SOC #SOAR #Kiberxavfsizlik #BepulKurs #NetAcad #TahdidTahlili

🎯 Tahdidni kutib o'tirmang — o'zingiz ovlang!

Oddiy analistlar ogohlantirishni kutadi. Threat Hunter esa hujum bo'lmasidan oldin uni topadi!
Cybersecurity Defense Analyst yo'nalishining 8-kursi — so'nggi va eng kuchli bosqich! 👇

📖 Kursda nima o'rganasiz?
✅ Maqsadli ov — gipotezaga asoslangan va bazaviy yondashuv bilan yashirin tahdidlarni aniqlash
✅ PEAK Freymvorki — tahdidni ovlash missiyasini tayyorlash, bajarish, tahlil qilish va harakat qilish metodologiyasi
✅ Splunk bilan ishlash — qidiruvlar o'tkazish, g'ayritabiiy holatlarni aniqlash va xavfsizlik ma'lumotlarini tahlil qilish
✅ Hacker kabi fikrlash — shubhali xatti-harakatlar va g'ayrioddiy naqshlarni sezish mahorati

🏆 Kursni tugatganingizdan so'ng?
Bu kurs sizni Splunk Certified Cybersecurity Defense Analyst sertifikatiga tayyorlaydi — bu esa ish bozorida sizni boshqalardan ajratib turadigan hujjat!

🔗 Bepul ro'yxatdan o'ting:
👉 https://www.netacad.com/courses/splunk-soc-essentials-introduction-to-threat-hunting?courseLang=en-US&instance_id=69934445-2f56-4718-8ca2-d5728362e354

💡 8 ta kurs — 1 ta maqsad: Professional Kiberxavfsizlik Analisti bo'lish! Siz bunga tayyormisiz? 🔥

@cisco_server

#ThreatHunting #Splunk #SOC #Sertifikat #BepulKurs #NetAcad #Kiberxavfsizlik

🏅 8 ta kursni tugatdingizmi? Endi bilimingizni isbotlash vaqti!

Siz kiberlandshaft, tahdidlar, Splunk va SOC operatsiyalarini o'rgandingiz. Endi rasmiy raqamli badge olish uchun bir qadam qoldi!
Cybersecurity Defense Analyst Pathway Imtihoni — ochiq! 👇

📝 Imtihonda nima tekshiriladi?
✅ Kiber landshaft, umumiy freymvorklar va standartlar
✅ Tahdid va hujum turlari, raqib motivlari, TTPlar
✅ Tahdid razvedkasining darajalari
✅ SIEM eng yaxshi amaliyotlari va Splunk ES operatsiyalari
✅ CIM, Data Models, Asset & Identity freymvorklari o'rtasidagi bog'liqlik
✅ Tergov ish oqimlari, Risk Based Alerting va korrelyatsiya qidiruvlari
✅ TSTATS, EVAL, REX, LOOKUP buyruqlari bilan samarali SPL yozish
✅ Anomaliya aniqlash va xulq-atvor tahlili orqali tahdid ovlash
✅ SOAR playbook'lari va adaptiv javob harakatlari

🎖 Imtihondan o'tsangiz nima olasiz?
Rasmiy raqamli badge — uni:
🔹 Resumeingizga qo'shing
🔹 LinkedIn profilingizda ko'rsating
🔹 Ish beruvchilarga bilimingizni rasman tasdiqlang!

🔗 Imtihonga ro'yxatdan o'ting:
👉 https://www.netacad.com/exams/splunk-cyber-defense-analyst-pathway?courseLang=en-US&instance_id=25c016a4-f709-4d4f-911c-629880921291

💡 8 ta kurs + 1 ta imtihon = Tasdiqlangan Kiberxavfsizlik Analisti! Omad! 🍀


@cisco_server

#Sertifikat #Badge #Splunk #SOC #Kiberxavfsizlik #NetAcad #Karyera #LinkedIn

#Encore

📡 ENCOR 350-401 | Chapter 6
IP Routing Essentials

🔥 CCNA da aytilmagan KEY POINTS
━━━━━━━━━━━━━━━━━━

1️⃣ TERMINOLOGIYA FARQI

Path — ikki tarmoq orasidagi mavjud havolalar
Route — routing protokoli tanlagan yo'l (RIB da)

⚡️ CCNA da path = route deyiladi
ENCOR da bular FARQ QILADI


━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
2️⃣ RIP TIMERLAR

🕐 Update → 30s (table yuborish)
🕐 Invalid → 180s (update kelmasa → invalid)
🕐 Holddown → 180s (yomon info bloklash)
🕐 Flush → 240s (table dan o'chirish)

⚡️ Holddown nima qiladi?
Route tushgandan keyin 180s davomida
"yaxshi" yangi ma'lumotni QABUL QILMAYDI
→ Routing loop oldini oladi

⚡️ RIP da Hello YO'Q
Qo'shni o'ligini 180s kutib bilib oladi
(OSPF = 40s, EIGRP = 15s)


━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
3️⃣ OSPF FLOODING QACHON TUGAYDI?

Down → Init → 2-Way → Exchange → FULL

⚡️ Router "tugadi" deb bilmaydi
U LSDB ni qo'shnisi bilan TAQQOSLAYDI
Full state = LSDB bir xil = sinxron


━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
4️⃣ PATH SELECTION — 3 QADAM

1. Prefix Length /28 > /26 > /24
2. AD past AD → ustun
3. Metric past metric → ustun

📋 DEFAULT AD JADVALI

Connected → 0
Static → 1
eBGP → 20
EIGRP internal → 90 ✅
OSPF → 110 ✅
IS-IS → 115
RIPv2 → 120
EIGRP external → 170
iBGP → 200 ✅

⚡️ iBGP AD = 200
CCNA da o'tilmaydi
BGP iBGP path tanlasa → RIB ga AD=200
OSPF (110) uni preempt QILMAYDI


━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
5️⃣ ECMP vs UNEQUAL LOAD BALANCING

ECMP → barcha IGP (RIP, EIGRP, OSPF, IS-IS)
• Metric bir xil → ikkala path RIB ga
• Traffic teng taqsimlanadi

Unequal-Cost → FAQAT EIGRP
• Default o'chiq — variance bilan yoqiladi
• Metric farqli → nisbatga qarab taqsimlaydi

⚡️ show ip route — ECMP ko'rinadi
⚡️ show ip route x.x.x.x — traffic share count


━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
6️⃣ STATIC ROUTE — 3 TUR

Directly Attached
ip route net mask INTERFACE
→ Faqat P2P (Serial) da ishlating!

Recursive
ip route net mask NEXT-HOP-IP
→ Ethernet da xavfli — link tushsa
noto'g'ri interfeysga o'tib ketadi

Fully Specified ✅
ip route net mask INTERFACE NEXT-HOP-IP
→ Ethernet + static = HAR DOIM shu!

⚡️ Ethernet + Directly Attached = XATO
Har paket uchun ARP ishlaydi
→ CPU va xotira sarflanadi → tizim beqaror

⚡️ Ethernet + Recursive = XAVFLI
Link tushsa → RIP 180s kutadi
Static darhol noto'g'ri yo'lga o'tadi


━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
7️⃣ FLOATING STATIC — BACKUP TEXNIKA

ip route 10.0.0.0 255.0.0.0 10.1.1.2 10
ip route 10.0.0.0 255.0.0.0 Serial1/0 210

AD=10 → asosiy (RIB da ko'rinadi)
AD=210 → backup (asosiy tushsa faollashadi)

⚡️ AD o'zgartirish routing loop ga
olib kelishi mumkin — ehtiyot bo'ling!


━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
8️⃣ NULL0 — LOOP OLDINI OLISH

ip route 172.16.0.0 255.255.240.0 Null0

Aniq route (longer match) → yo'naltiriladi ✅
Aniq route yo'q → Null0 DROP ✅ (loop yo'q)

⚡️ Summary route + Null0 = standart pattern
ISP lar va enterprise da keng ishlatiladi


━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
9️⃣ VRF — KOMANDALAR TARTIBI

vrf definition MGMT
address-family ipv4

interface GigabitEthernet0/3
vrf forwarding MGMT
ip address 10.0.3.1 255.255.255.0

⚡️ vrf forwarding kiritilganda
IP manzil AVTOMATIK o'chadi — normal holat!
Keyin qayta yozing

⚡️ show ip route — VRF interfeyslar KO'RINMAYDI
show ip route vrf MGMT — ko'rinadi


━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
🔟 RIB vs FIB — ENG MUHIM FARQ

RIB (Routing Table)
• Control Plane
• RAM da saqlanadi
• Best path hisoblash
• show ip route

FIB / CEF (Forwarding Table)
• Data Plane
• TCAM — hardware darajasida
• Real paket yo'naltirish
• show ip cef

⚡️ SDN va Controller-based arxitekturada
Control Plane va Data Plane ajratish
ENCOR ning asosiy mavzularidan biri

📚 ENCOR 350-401 Official Cert Guide
2nd Edition — Chapter 6

✍️ CCIE Enterprise Infrastructure seriyasidan @cisco_server

Deyarli hammamizda vaqt yo'q, ulgurmayapman, nimadan boshlashni bilmayapman degan hisiyotlar o'tadi.

""Kompyuterda uzoq vaqtdan buyon yopilmay yotgan "Vkladkalar" qanchalik RAMni sarflasa, oxiriga yetmagan ishlarimiz bilan ham huddi shunday bo'ladi""

Shu muammodan qutilish uchun ushbu qarmoqlar usulidan foydalaning , miyyangizdagi hamma o'y fikrlarni daftarga tushirib qo'ying.

Shunda miyya ancha bo'shaydi, ana endi o'sha ishlarni ichidan bir qarab chiqib 2-5 minutda bitadiganlarini birinchi ajratib olib xozirni o'zida bajarib qo'ying.

Qolgan katta zadachalaringizni qanday bajarish maqqulligi qiziq bo'lsa, reaksiyalaringizga qarab uni ham ossonroq hal etish yo'lini o'rgataman.

@cisco_server

#Encore

📡 ENCOR 350-401 | Chapter 7

📡 EIGRP — CCNA da aytilmagan KEY POINTS
━━━━━━━━━━━━━━━━━━

🧠 DUAL Algoritmi
EIGRP oddiy distance vector emas. DUAL
(Diffusing Update Algorithm) loop-free
backup yo'llarni oldindan hisoblaydi va
convergence ni tezlashtiradi.

━━━━━━━━━━━━━━━━━━

📊 FD, RD va Feasibility Condition

- FD (Feasible Distance) — router o'zi
hisoblagan to'liq path metric

- RD (Reported Distance) — qo'shni
e'lon qilgan o'z masofasi

- Feasibility Condition:
✅ RD < FD → Feasible Successor
❌ RD ≥ FD → Backup sifatida qabul
qilinmaydi (loop xavfi)

💡 RD — bu qo'shni masofasi, to'liq
path metric emas! Path metric = RD +
o'zingning link cost.

━━━━━━━━━━━━━━━━━━

⚖️ Unequal-Cost Load Balancing

EIGRP variance multiplier orqali har xil
metrikdagi yo'llarni bir vaqtda ishlatadi.

Variance = Feasible Successor FD ÷
Successor FD (yuqoriga yaxlitlanadi)

Feasible Successor FD < Variance qiymati
bo'lsa → RIB ga o'rnatiladi.

━━━━━━━━━━━━━━━━━━

🔄 Convergence: Passive vs Active

- Passive (P) → topology barqaror ✅
- Active (A) → yo'l yo'qoldi, DUAL
hisoblash boshlandi ⚙️

Feasible Successor bor → darhol
Passive ga qaytadi (hech kim bilmaydi)

Feasible Successor yo'q → Query jarayoni
boshlanadi.

━━━━━━━━━━━━━━━━━━

📨 Query / Reply Mexanizmi

Query kelganda router MAJBURIY javob
berishi shart. 2 ta to'g'ri javob:
1️⃣ "Bu prefix menda yo'q"
2️⃣ "Menda boshqa yo'l bor" (+ attributes)

Jim qolish = o'lim 💀

Reply Status Flag — router yuborgan har
bir query uchun, har bir qo'shni bo'yicha
alohida kuzatiladi. Barcha flag = 0
bo'lganda DUAL yakunlanadi.

━━━━━━━━━━━━━━━━━━

🆘 SIA — Stuck In Active

Query ga 3 daqiqada reply kelmasa →
adjacency RESET (faqat o'sha prefix emas,
BARCHA prefix lar uchun!)

1.5 daqiqada SIA-Query yuboriladi:
"Sen tiriksan, lekin nima bo'ldi?"

Hello timer ≠ SIA-Query:
- Hello → "Qo'shni tirikmi?" (adjacency)
- SIA-Query → "DUAL hisoblash
tugatdingmi?" (computation)

Router tirik bo'la turib ham javob bera
olmasligi mumkin — chunki u ham chuqurroq
birovni kutmoqda!

━━━━━━━━━━━━━━━━━━

📦 Classic vs Wide Metrics

Classic → delay 10μs, bandwidth kbps
❌ 11 Gbps va 50 Gbps ni ajrata olmaydi

Wide → delay pikosekund (10⁻¹²),
65,536 ga ko'paytirilgan
✅ 655 Tbps gacha masshtab

K₆ → jitter, energy kabi extended
attribute lar uchun qo'shimcha qiymat

━━━━━━━━━━━━━━━━━━

🗺 Route Summarization — Null0 siri

R2 summary advertise qilganda o'z
routing table iga avtomatik:
172.16.0.0/16 → Null0 ⛔️
qo'shadi.

Mavjud bo'lmagan /24 ga paket kelsa:
→ Longest Match → Null0 → DROP
→ Loop emas, Black Hole nazorat ostida

⚠️ Summarization ishlashi uchun har bir
region ga UNIQUE address blok berilishi
shart. Bir xil summary → Black Hole!

━━━━━━━━━━━━━━━━━━
⏱️ Timers

Fast Slow (T1↓)
Hello │ 5 sec │ 60 sec
Hold │ 15 sec │ 180 sec

Hold = Hello × 3 (default)
Hold = 0 → neighbor unreachable →
DUAL ga topology change xabari

━━━━━━━━━━━━━━━━━━

#EIGRP #CCNP #ENCOR #Networking

@cisco_server