Most of the network forensics tool discussion focuses on two types of use cases. These are, on a high level:
- incident response and investigations of captured traffic, either related to a specific incident or based on suspicions, such as about a user or an activity.
- ongoing monitoring such as by fusing decoded traffic captures with blacklist/reputation data or by NIDS-style pattern matching.
However, in this "age of APT" there is another sneaky use case for these tools that few security people understand (on the other hand, some of the pcap literati, who were brought up playing with packets since kindergarten, actually understand it pretty well).
This "mystery use case" is data exploration, which is neither clue-driven like investigations, nor constant and ongoing like monitoring. This use case is about getting a big pot of good coffee, a network forensics tool and a few terabytes (yes, terabytes – but, beginners, please start from mere gigabytes ) of freshly gathered packets. And then just letting the magic happen. Some organizations call it “hunting”, others call it “assuming a compromise – then looking for it”, while others (and myself in this post) prefer “data exploration” as a label for this exciting activity.
This process will sometimes reveal indicators to investigate, and sometimes new monitoring practices to initiate. In almost all cases, it will yield useful knowledge, such as that about your network, your systems, and about your threats and vulnerabilities. Or, occasionally, about the fact that you were owned by the Chinese non-stop since 2010 As I said, useful knowledge it would be!
Comments or opinions expressed on this blog are those of the individual contributors only, and do not necessarily represent the views of Gartner, Inc. or its management. Readers may copy and redistribute blog postings on other blogs, or otherwise for private, non-commercial or journalistic purposes, with attribution to Gartner. This content may not be used for any other purposes in any other formats or media. The content on this blog is provided on an "as-is" basis. Gartner shall not be liable for any damages whatsoever arising out of the content or use of this blog.