Cybersecurity Ops with bash

Chapter 5. Data Collection

Data is the lifeblood of nearly every defensive security operation. Data tells you the current state of the system, what has happened in the past, and even what might happen in the future. Data is needed for forensic investigations, verifying compliance, and detecting malicious activity. Table 5-1 describes data that is commonly relevant to defensive operations and where it is typically located.

Table 5-1. Data of interest

Data	Data Description	Data Location
Logfiles	Details on historical system activity and state. Interesting logfiles include web and DNS server logs, router, firewall, and intrusion detection system logs, and application logs.	In Linux, most logfiles are located in the /var/log directory. In a Windows system logs are found in the Event Log.
Command history	List of recently executed commands.	In Linux, the location of the history file can be found by executing echo $HISTFILE. This file is typically located in the user’s home directory in .bash_history.
Temporary files	Various user and system files that were recently accessed, saved, or processed.	In Windows, temp files can be found in c:\windows\temp and %USERPROFILE%\AppData\Local\. In Linux, temp files are typically located in /tmp and /var/tmp. The Linux temporary directory can also be found by using the command echo $TMPDIR.
User data	Documents, pictures, and other user-created files.	User files are typically located in /home/ in Linux and c:\Users\ in Windows.
Browser ...