Now that we're able to extract and generate structure data based on log files,
we can move to the next stage of performing analysis and
generating insights about suspicious patterns.
In this module,
we'll start off with log enrichment and see how we can add additional
information to the log data based on another dataset.
Then,
we'll move into detecting command and control traffic and beaconing based
on correlating multiple network logs and extracting information about the
connection duration and the number of requests.
We will perform occurrence and similarity analysis on DNS
traffic logs to identify rogue domains.
Some patterns are better visualized as graphs
rather than numeric representation.
And for this,
we'll be plotting log data to discover suspicious patterns
based on user activity and time correlation.
And with that said, let's jump right in.