Chapter 4, Collecting Network Evidence, explored how incident responders and security analysts are able to acquire network-based evidence for later evaluation. That chapter focused on two primary sources of that evidence, network log files and network packet captures. This chapter will show which tools and techniques are available to examine the evidence acquired. Incorporating these techniques into an incident response investigation can provide incident response analysts with insight into the network activity of possible threats. In this chapter, the following main topics will be addressed:
- Network evidence overview: Adversaries are bound to the same network protocols that govern normal network traffic. Adversarial techniques that can be identified with the proper analysis of network data are addressed.
- Analyzing firewall and proxy logs: Adversaries...