All right, digital evidence.
Log files.
Log files are examples of digital evidence.
Log files need to be created contemporaneously with the event.
They need to be part of a regularly conducted business activity.
Otherwise, they're considered to be random
compilations of data and they're not admissible.
Log files, we've talked about log files.
This is system generated reports that contain information related user
activities, software applications, OS servers, network communication.
We just talked about a couple of models back.
We got network logs, we got system logs, we got application logs.
Again, Windows event logs, we got network
monitoring logs, we got firewall logs, we got router logs.
Let's check back in and see how our authentication is doing.
It's done. I'm going to cat hashes.
Txt and lookie there, they both match.
There you go.
Sdb and SDC match 100 %.
Security logs, web access logs, and DNs logs.
They're all pretty self explanatory.
Security logs, filled logins, passwords,
resources, the security login windows we just looked at it.
Web access logs, IIS, and Apache has a dedicated type of access log.
Our dns logs, any DNA server activity, that can actually be
Wireshark where you're filtering for inbound dns addresses.
Dump files.
Compressed version system log files
recorded when the system crashes or turned off unexpectedly.
A system dump file is no replacement for a memory dump.
When we do an imaging of memory, that imaging of memory is done at the time of
acquisition, a dump file or a crash file that's created because the system
encountered an unstable state in blue screen is not a replacement for that.
We also have things like hibernation
files, which are a dump file of memory at the time the system last hibernated.
Authentication logs, we talked about.
Session Initiation Protocol is void related.
Sip logs contain details about established, maintained, or disconnected
applications like live conferences, chats, and voice calls.
Siem dashboards.
Siem, you cannot understate the importance of security information and event
management systems since everything reports to the SIEM.
Dashboards visualize actionable data for various log events.
And again, you've seen some examples of this.
You've played around a bit with splunk enterprise.
Sensors aggregate logs from various
neighboring sources, correlate them with device data.
Again, you've got sensors and consolidation points.
And sensitivity, security specialists
apply correction rules to sensitivity levels to aggregated data.
It can be achieved by manipulating AI and
machine learning capability in security situations.
Again, that's the waiting.
That's part of that anomaly sensitivity tuning.
Automated alerts.
Alerts generated by sensors implement
security solutions and hardware appliances when they encounter attack signatures.
They are also classified by threat severity level, low, medium, or high.
We've talked about all this, talked about
IDS, IPS, and they also need to be verified.
Remember, the criticality gives us an
initial idea of how quickly we need to respond.
Correlation is a correlation of multiple events that point to some activity.
Security solutions apply correlation
rules, integrate multiple log sources, and transform data into useful information.
If you see several events from several
systems, that could indicate a traversal from an attacker from one system to
another, a pivot, or lateral movement through the network.
Correlated logs help investigators track
the time out of the events that led to a security incident.
All right, bandwidth monitors.
We talked a little bit about this in network monitoring.
Network traffic analysis, where you're looking for issues with service conditions
or denial of service, quality of service, bandwidth monitors can be helpful.
Solar Winds.
Solar Winds got some bad press here over the last year and a half or so because the
solar winds hacked, but lots of great utilities.
Their network bandwidth analyzer pack,
topology mappers, tons of cool solar winds products.
Metadata.
Metadata present in the file system can
provide easy understanding of incidents, the investigation process, which might
include unapproved deletion and modification of files.
Metadata is really anything other than the data itself.
Data about data can be acquired from
various data sources like email, mobile, web, and file systems.
Investigators use tools like Metadata
Assistant, Parabin P2 Commander, Metasheets to analyze metadata.
Metadata can be author, computer name, on documents.
It can be timestamps, it can be summary information and so forth.
Some of this can give away authors of specific files, things like that.
A lot of it can be used to footprint networks as well, looking for user
accounts within an organization for social engineering attacks.
All right, netflow.
Okay, netflow, network protocol used to gather, monitor, and analyze network as it
passes through load balancers, switches and other routing devices.
It inspects your traffic flow and
generates flow statistics that help investigators in bandwidth monitoring,
threat detection, aggregation, and forensic analysis.
Again, you're just monitoring traffic flow.
Again, this doesn't necessarily indicate a
denial of service attack, but it could indicate a performance issue based on a
misconfigured application or maybe even a necessary service.
Vulnerability scan outputs.
Really useful since vulnerability scans point to the existence of vulnerabilities,
which means you're exposed, which means they can be exploited.
Vulnerability scan reports consistent, detective vulnerabilities, bugs,
configuration weaknesses, exploit to launch cyber attacks.
The output of the vulnerability scan,
which we've seen before, acts as important evidence during a forensic investigation.
If it's a web application and you're investigating an intrusion, part of that
might be doing a vulnerability analysis of the compromise system.
A confirmation of that vulnerability can
be used to identify, again, the intrusion vector and definitely illustrates the
existence of the vulnerability and the probability of how it was exploited.
Provides information on the attack might have been performed by mapping with
exploit databases of identified vulnerabilities.
Protocol Analyzer Output.
Security solutions like SIM capture network traffic from every corner and
aggregate the packets to analyze them using protocol analyzers.
Again, the results of analyzers can be used to trouble shoot network issues.
Wiresh art is a protocol analyzer.
Gigabit Ethernet BIAN, this whole data central dashboard, our Manage engine,
sorry, is another example of a correlation engine.
A lot of this can be done with Wiresh art.
It's not necessarily as polished, I mentioned that before, but you also have,
oh my gosh, Cascade Pilot, which is riverbeds enhancement to Wiresh art.
I can't remember what they're calling it
these days, but lots of utilities for correlating and
analyzing and reporting on network traffic.