Use Cases for Network Forensics Tools

Most of the network forensics tool discussion focuses on two types of use cases. These are, on a high level:

1. incident response and investigations of captured traffic, either related to a specific incident or based on suspicions, such as about a user or an activity.
2. ongoing monitoring such as by fusing decoded traffic captures with blacklist/reputation data or by NIDS-style pattern matching.

However, in this "age of APT" there is another sneaky use case for these tools that few security people understand (on the other hand, some of the pcap literati, who were brought up playing with packets since kindergarten, actually understand it pretty well).

This "mystery use case" is data exploration, which is neither clue-driven like investigations, nor constant and ongoing like monitoring. This use case is about getting a big pot of good coffee, a network forensics tool and a few terabytes (yes, terabytes – but, beginners, please start from mere gigabytes ) of freshly gathered packets. And then just letting the magic happen. Some organizations call it “hunting”, others call it “assuming a compromise – then looking for it”, while others (and myself in this post) prefer “data exploration” as a label for this exciting activity.

This process will sometimes reveal indicators to investigate, and sometimes new monitoring practices to initiate. In almost all cases, it will yield useful knowledge, such as that about your network, your systems, and about your threats and vulnerabilities. Or, occasionally,  about the fact that you were owned by the Chinese non-stop since 2010 As I said, useful knowledge it would be!

Related posts:

• Network Forensics Defined?