Comprehensive Guide to Network Forensics and SIEM System Management


  • Network Security Incident Discovery and Diagnostic Methodologies

    • Tools and Discovery: Network sniffers are identified as the primary tools for the discovery and identification of security incidents.

    • Analysis Types: There are two distinct methodologies for investigating security incidents:

      • Postmortem Analysis: Conducted after the event has concluded to determine the root cause and the extent of the damage.

      • Real-time Analysis: Performed while the event is ongoing to provide immediate diagnostics and mitigation.

    • Specialized Investigative Techniques:

      • Reference is made to "intel am with the thermal investigation."

      • A critical component is ensuring the distribution of a "no self attack" protocol.

      • Analyses focus heavily on Denial of Service (DoS) attacks and their variants.

    Network Forensics and Evidence Acquisition

    • Primary Evidence Sources: In the context of network forensics, evidence is typically gathered from:

      • Routers

      • Firewalls

      • Intrusion Detection Systems (IDS)

  • Application and User Correlation: Forensic efforts investigate how applications appear in traffic and manage the correlation of user events.

  • Data Processing Chain:

    • Transmission of Data: The process of moving captured forensic data for analysis.

    • Data Normalization: Standardizing data formats to ensure consistency across different systems and sources.

  • Graph-Based Forensic Approach: Utilizing a graph design to represent system components and "fault events" occurring within forensic cases.

Security Information and Event Management (SIEM) Solutions

  • Advanced Methodologies: Modern SIEM systems utilize automated approaches involving Machine Learning (ML) and Artificial Intelligence (AI) techniques.

  • Vulnerability and Incident Management: These solutions correlate payloads for network management to identify vulnerabilities and manage security incidents.

  • Core SIEM Functions:

    • Aggregation: The collection of log and event data from diverse sources.

    • Normalization: Formatting collected data into a unified structure.

    • Correlation: Analyzing separate data points to identify commonalities and complex attack patterns.

  • Database Infrastructure: These records are stored in a database server, such as Microsoft-based SQL servers, which capture essential metadata including:

    • IP addresses

    • Usernames

    • Windows event data

    • Firmware details

Log Management Software Installation and UI Configuration

  • Installation Workflow: The standard installation for log management tools (e.g., "Helena 55") follows a specific command sequence:

    • Accepting the License Agreement.

    • Interaction with "Next" prompts for configuration.

    • Executing the "Install" command.

    • Finalizing via the "Finish" action.

  • Authentication and Access Control: Troubleshooting often involves addressing "failed username or password" errors, specifically regarding Microsoft admin passwords or denied access at the password command line.

  • Graphical User Interface (GUI): Referred to as the "alligraphical user interface," the GUI provides monitoring for:

    • Local computer services and their operational status.

    • Event processing statistics (e.g., "four and two event sources" represented as 44 and 22).

    • Bijib: Defined as a term signifying the presence of two event resources.

Event Ingestion and Log Source Management

  • Windows Event Tracking: Security events and reports are primarily viewed via the Event Viewer and the Log Center Suite.

  • Log Manager Features:

    • Centralized logging for organizational efficiency.

    • Comprehensive log management workflows.

    • Correlation tools for pattern recognition.

  • Data Ingestion Procedures:

    • Adding a data source typically involves selecting "Windows event" and using the "Collect logs" action.

    • The creation of new accounts for tracking is supported.

    • Folder and Index Loop Management: Data can be added through folders and specific "index loop files."

    • Forensic Evidence Import: The system supports importing evidence files from specific storage paths, such as the "Evidence" folder on the local machine.

Traffic Capture and Forensic Analysis with Wireshark

  • Real-time Capture: Wireshark is utilized for capturing network traffic in real-time and reviewing captured traffic evidence files.

  • Protocol Analysis:

    • HTTP Methods: Analysis focuses on specific request types such as GET records and POST methods.

    • Traffic Statistics: Wireshark provides detailed statistics and conversation views to visualize network interactions.

    • Attack Detection: Analysts use these tools to inspect request histories and identify specific signatures of network-based attacks.