Network Traffic and Connectivity Log Analysis
Reconstructing an incident from network traffic
Network traffic and connectivity logs, generated by firewalls, routers, proxy servers or intrusion detection systems, make it possible to reconstruct how an attacker communicated with the compromised infrastructure, even when they've already erased direct traces on the affected systems. Analyzing full packet captures offers the highest level of detail, including the exact content of unencrypted communications, but requires considerable storage, so in practice many organizations rely on flow logs (NetFlow) or connection records, which document who communicated with whom, when and how much traffic was transferred, without capturing the full content. In practice, cross-referencing these records with timestamps from other systems is what makes it possible to build a coherent narrative of the incident, for example confirming that the data exfiltration happened minutes after a user opened a malicious file. The lack of adequate retention of these logs is one of the most frequent limitations forensic investigators face.