In Chapter 4, Collecting Network Evidence, there was a focus on the various sources of evidence that network devices produce. Most of this evidence is contained within the variety of log files produced by switches, routers, and firewalls. Depending on the type of environment that responders find themselves in, this evidence source can be augmented with NetFlow data and full packet captures.
Once the various sources are understood, it is important to then focus on what logs, NetFlow, and packet captures can tell us about an incident. The following are several areas of focus where proper logging and evidence collection may provide additional context surrounding an incident, as well as potential data points when deriving root cause:
- Reconnaissance and scanning behavior: There are a plethora of tools available to adversaries to automate scanning of perimeter...
