Part 3: Investigating Network Threats by Using Firewall and Proxy Logs

As malware increasingly communicates over a network to discover other systems, pivot to them, communicate with its C&C server, or exfiltrate collected data, it is crucial to have a comprehensive understanding of how to detect and investigate them effectively. This part of the book covers the importance of analyzing network security logs, specifically firewall and proxy logs, in identifying and investigating security incidents. Chapter 8 provides a comprehensive overview of the firewall logs' structure and how to use them for incident investigation. Chapter 9 then dives into the specifics of detecting and investigating reconnaissance, lateral movement, command and control, and denial-of-service attacks by using firewall logs. Chapter 10 explores the value of proxy logs and their anatomy, providing a thorough understanding of the types of information they contain. Finally, Chapter 11 focuses on investigating...