CF1 18 - Network TextLogs.pdf

(2360 KB) Pobierz
Network and Text Logs
NBE (Network Based Evidence)
Text based logs
Analysing and working with logs
Typer av loggar
• Nätverks device loggar
– Routrar, switchar etc.
• Firewall loggar
– Ingående, utgående och droppade paket
• IDS (Intrusion Detection System) loggar
– Suspekta paket, attacker
• Server loggar
– WWW, MTA, FTP, DBMS etc.
– Access, error, connection status, queues, logins, activity,
executed commands, etc.
• IPS (Intrusion Prevention System) loggar
– System anrop loggar etc.
• Klient/system loggar
– Security, application, system
System loggar
• Windows XP och Vista/7
– Binära och låsta (.evt, .evtx)
– Lagrar loggar i C:\Windows\system32\config\ eller
C:\windows\system32\winevt\Logs\
•
Appevent.evt(x)
- Contains a log of application usage
•
Secevent.evt(x)
- Records activities that have security implications
such as logins
•
Sysevent.evt(x)
- Notes system events such as shutdowns
– Det mesta av loggningen är avslagen som default
– Verktyg som tex. MS dumpel och MS Log Parser (klarar fler
format) kan användas för att parsa loggarna samt Event Viewer
• UNIX/Linux
– ASCII
– /etc/syslog.conf talar om var loggarna finns
• Under /var/log ligger det mesta ang. systemet normalt
– History etc. finnas i /home/<user> mappen, tex.
• .shellName_history
NBE (Network Based Evidence) and NSM
• Full content data
–
Records everything – lots of disk space may be needed
–
Tcpdump/windump/dumpcap, wireshark, ngrep, networkminer...
• Session data
libpcap/WinPcap
–
Records just the session: time stamp, pid, start/stop, type, IP-
source/destination port and state, etc.,
usually built-in
–
Microsoft Port Reporter (and port reporter parser) tool -
http://support.microsoft.com/kb/837243
–
Argus - http://www.qosient.com/argus/
–
Tcptrace - http://tcptrace.org/
• Alert data
–
Analyze the NBE for predefined items of interest with rules or
signatures
–
Normally done by a network IDS/IPS as Snort or Bro Intrusion
Detection System etc.
NetworkMiner and Wireshark
Jonathan James - [server]\training_forensics_networkanalysis\
youtube.com-user-techworldsverige\Kontrollera ditt nätverk med Wireshark
Erik Hjelmvik
http://www.netresec.com/?page=Blog

Plik z chomika:

Inne pliki z tego folderu:

Inne foldery tego chomika:

Zgłoś jeśli naruszono regulamin