Network Forensics
Security
Overview
Correlate timestamps, flow tuples, DNS, authentication and endpoint evidence. Preserve originals and track how evidence was acquired. A single unusual connection is a lead, not proof of compromise. Distinguish observations from hypotheses and explain confidence and missing data.
Protocol stages
- 1Capture/log
- 2Normalize time
- 3Correlate flow
- 4Hypothesis
- 5Validate
Interactive exercise
Knowledge check
DNS logs show a rare name and a flow to its IP. Does that alone prove data exfiltration?
Educational model — not real hardware, traffic or official certification.