4.9 Given a scenario, use data sources to support an investigation

★ Starred in your notes: know the output of nslookup, arp, nbtstat, netstat, routing tables, ping, ipconfig (Cheat sheets → Command outputs) · syslog level 7 = debug (0 = emergency).

Breakdown 1 — Log data (what each log tells you)

Log source	What you find in it	Investigation use
Firewall logs	Allowed/denied connections, source/dest IP and port, rule hit	Was the C2 connection blocked? Who scanned us? Exfil volume
Application logs	Logins, errors, transactions, input that broke something	SQLi attempts, failed auth, abuse of business logic
Endpoint logs	Process creation, file changes, USB events, EDR telemetry	What ran, what it touched, persistence
OS-specific security logs	Windows Event Viewer Security log (4624 logon, 4625 failed, 4720 account created), Linux auth.log/secure, journalctl	Account misuse, privilege escalation
IPS/IDS logs	Signature hits, anomalies	What attack pattern, how often, from where
Network logs	Switch/router logs, DHCP leases, DNS queries, NetFlow	Map who talked to whom; DNS shows C2 lookups
Metadata	Timestamps, authors, geolocation, headers, file properties	"Apart from content, the most interesting thing" — builds the timeline

From class — syslog severity levels (know the ends): 0 Emergency (most critical) · 1 Alert · 2 Critical · 3 Error · 4 Warning · 5 Notice · 6 Informational · 7 Debug ★ (least critical, most verbose). Syslog UDP 514 / TLS 6514. SIEM vs. syslog: syslog collects; the SIEM aggregates, correlates, alerts, retains, and analyzes — "allows you to see almost real-time." User behavior analytics — e.g., Splunk UBA — baselines each user and flags anomalies.

Breakdown 2 — Other data sources

Source	Use
Vulnerability scans	Was the exploited flaw already known/open? Which other hosts have it?
Automated reports	Scheduled SIEM/EDR/vuln reports — trends, compliance evidence
Dashboards	Real-time view of alerts, failed logins, traffic — situational awareness
Packet captures	Full content: packet sniffers capture, packet analyzers (Wireshark) decode; from a SPAN/port-mirror, a TAP (terminal/test access point — passive hardware), or a network packet broker (NPB) that filters and distributes traffic to tools (class)

From class — inline vs. tap-based monitoring: inline devices (IPS) can block but add latency and risk; SPAN mirrors traffic in software (can drop packets under load); a TAP is a physical passive copy; an NPB aggregates many taps/SPANs. A MAC flood attack fills a switch's CAM table so it floods traffic like a hub — an attacker's way to "sniff" on a switched network.

Breakdown 3 — Command-line tools you must recognize by their output

From class ★: "Look into how the output of these commands looks like; know the output; create examples." Full samples are in Cheat sheets → Command outputs.

Command	Shows	Investigation question it answers
ipconfig /all (Win) · ifconfig / ip a (Linux)	IP, mask, gateway, DNS servers, MAC	Is this host on the right subnet? Rogue DNS server configured?
ping	Reachability, RTT, TTL	Is the host up? (TTL hints at OS: 128 Windows, 64 Linux)
arp -a	IP ↔ MAC table	ARP poisoning: gateway IP mapped to a wrong MAC; duplicate MACs
netstat -ano (Win) · ss -tulpn (Linux)	Listening ports, active connections, owning PID	Unexpected listener (backdoor), connection to a strange IP (C2)
nslookup / dig	DNS answers, which server answered	DNS poisoning/pharming: wrong IP for a known name
route print / ip route / netstat -r	Routing table	Rogue route redirecting traffic (on-path)
nbtstat -A <ip>	NetBIOS names/MAC of a Windows host	Identify a machine by IP; enumeration
tracert / traceroute	Hop-by-hop path	Where traffic is being diverted
nmap	Open ports/services on a target	"nmap website — check what ports are open"; -sS = half-open (SYN) scan (stealthier; unauthorized scanning can be illegal)
head / tail / cat / grep	First lines / last lines / join files / filter by pattern or regex	Pull the relevant lines out of a huge log: grep -i "failed password" auth.log | tail -n 50

Breakdown 4 — Putting it together (scenario flow)

1. Alert fires (SIEM/EDR) → 2. Confirm with endpoint + OS logs (what process, which account) → 3. Scope with firewall/NetFlow/DNS (who else talked to that IP/domain) → 4. Capture packets or memory if still active → 5. Check vulnerability scan history for the initial hole → 6. Preserve evidence (hash, chain of custody — 4.8) → 7. Report with metadata-based timeline.

Exam tip: "Which log shows a blocked outbound connection?" → firewall. "Which shows a new local admin was created?" → OS security log (Event Viewer). "Need the actual content of the session" → packet capture. "Find every failed SSH login in a 2 GB log" → grep. "Least severe syslog level" → 7 debug; "most severe" → 0 emergency. "arp -a shows two IPs with the same MAC" → ARP poisoning / on-path.

Quick self-check

• Syslog 0 and 7 mean? (Emergency; Debug.)
• SPAN vs. TAP? (Software mirror vs. passive hardware copy.)
• Which command exposes ARP poisoning? (arp -a.)
• SIEM vs. syslog? (Correlate/alert/retain vs. just collect.)