Anton Chuvakin

A member of the Gartner Blog Network

Anton Chuvakin
Research Director
1 year with Gartner
12 years IT industry

Anton Chuvakin is a research director at Gartner's IT1 Security and Risk Management group. Before Mr. Chuvakin joined Gartner, his job responsibilities included security product management, evangelist… Read Full Bio

Coverage Areas:

← →

Use Cases for Network Forensics Tools

by Anton Chuvakin  |  February 5, 2013  |  3 Comments

Most of the network forensics tool discussion focuses on two types of use cases. These are, on a high level:

  1. incident response and investigations of captured traffic, either related to a specific incident or based on suspicions, such as about a user or an activity.
  2. ongoing monitoring such as by fusing decoded traffic captures with blacklist/reputation data or by NIDS-style pattern matching.

However, in this "age of APT" there is another sneaky use case for these tools that few security people understand (on the other hand, some of the pcap literati, who were brought up playing with packets since kindergarten, actually understand it pretty well).

This "mystery use case" is data exploration, which is neither clue-driven like investigations, nor constant and ongoing like monitoring. This use case is about getting a big pot of good coffee, a network forensics tool and a few terabytes (yes, terabytes – but, beginners, please start from mere gigabytes Smile) of freshly gathered packets. And then just letting the magic happen. Some organizations call it “hunting”, others call it “assuming a compromise – then looking for it”, while others (and myself in this post) prefer “data exploration” as a label for this exciting activity.

This process will sometimes reveal indicators to investigate, and sometimes new monitoring practices to initiate. In almost all cases, it will yield useful knowledge, such as that about your network, your systems, and about your threats and vulnerabilities. Or, occasionally,  about the fact that you were owned by the Chinese non-stop since 2010 Smile As I said, useful knowledge it would be!

Related posts:

3 Comments »

Category: monitoring network forensics security     Tags:

3 responses so far ↓

  • 1 Jose Peñaloza   February 5, 2013 at 8:02 pm

    The SIEMs solutions are playing here?

  • 2 Anton Chuvakin   February 5, 2013 at 9:00 pm

    Sort of (e.g. see recent announcements), but most of this is done via dedicated tools

  • 3 Processes for Network Forensics   February 15, 2013 at 7:13 pm

    [...] data exploration process aimed at understanding what is going on, was going on, which  may be based on a threat hypothesis or other suspicions (see additional details on this here) [...]