Every device on a network generates some kind of logs for each and every action carried out on the network. Capturing and analyzing the log files are important tasks for investigating the security posture of the target network, as they contain information about all the system, device, and user activities that took place within the network.
Objective
TThe objective of this lab is to provide the forensic investigator knowledge on capturing and analyzing the logs of a network and other responsibilities. The lab aims to capture and analyze:
- Security event logs
- Application event logs
- System event logs
- Other logs of Microsoft Windows operating systems
Scenario
James is working as a team leader in an MNC company. Sam is an efficient, honest, and dedicated member of James's team, but recently James noticed a big drop in Sam's performance. Through the other team members, James found out that Sam is wasting a lot of time browsing and chatting on social networking sites. James called Sam to ask him to explain the drop in his performance, and Sam lied, saying his current project is very difficult to understand and time consuming. Before taking any serious action against Sam, James wants to capture and analyze all the logs of Sam's computer to know how he is spending his time in the office.
Log Capturing and Event Correlation
Incident Handling Exercises / Log Capturing and Event Correlation contains the following Exercises:
- Investigating System Log Data Using XpoLog Center Suite Tool
- Viewing Event Logs Using Kiwi Syslog Server Tool
The Virtual Private Cloud for this Lab set utilizes:
Incident Handling Exercises are available as part of the following subscription:
Each subscription provides 6 months access to over 75 Different Exercises. Each exercise contains a Scenario, Objectives, and individual step by step tasks to guide the user through all steps necessary to complete the exercise.
Lab exercises are included for:
- Trojans and Backdoors
- Computer Forensics Investigation Process
- Understanding Hard Disks and File Systems
- Forensics Investigation Using AccessData FTK
- Forensics Investigation Using EnCase
- Log Capturing and Event Correlation
