Digital Forensics and Incident Response

Analyzing network log files

Chapter 3, Network Evidence Collection, contained a good deal of information concerning the acquisition of network-based evidence and the types of log files that are of importance to incident response analysts. Aside from the previously covered packet capture, there was a good deal focused on the acquisition of log files from a variety of sources. These log files can provide some insight into the potential indicators of compromise that can aid in an incident investigation. The main challenge though for analysts is sifting through all of the non-relevant logs to find those that have some evidentiary value.

Log file analysis can be performed in a variety of ways. The specific method that is used may often depend ...