To gain a comprehensive overview of the incident involving DDOS attacks and ransomware, the SOC engineer should run and evaluate a full packet capture on the workloads, review Security Information and Event Management (SIEM) logs, and define a root cause. This will help in understanding the nature of the attacks, the extent of the damage, and the vulnerabilities that were exploited

To prevent network availability issues related to peak memory pool buffer usage, the engineer should enable memory threshold notifications. This action allows the system to alert administrators before the memory usage reaches a critical level, enabling them to take proactive measures to prevent malfunction

Wireshark decrypts TLS network traffic by using a key log file that contains per-session secrets1. This method is effective even when Diffie-Hellman (DH) key exchange is used, which is common in modern encrypted communications. The key log file is typically generated by applications like web browserswhen the SSLKEYLOGFILE environment variable is set. This file records the necessary per-session secrets that Wireshark can then use to decrypt the traffic1.
It's important to note that while this method is universal and works across different TLS versions, including TLS 1.3, other methods such as using an RSA private key are limited to certain conditions and do not work with TLS 1.3 or when (EC)DHE cipher suites are selected1. Therefore, the key log file method is the most reliable and widely applicable approach for decrypting TLS in Wireshark.