Domain 4 · OperationsSecurity Operations2 min read
Data sources for investigations
Exam objective 4.9: Given a scenario, use data sources to support an investigation.
On this page
Investigations depend on choosing the right evidence. This objective covers log data from firewalls, applications, endpoints, operating systems, IPS/IDS, and the network, plus metadata, and other sources such as vulnerability scans, automated reports, dashboards, and packet captures.
Log data
| Source | Best for |
|---|---|
| Firewall logs | Which connections were allowed or blocked, by IP and port |
| Application logs | What users did inside an app, errors |
| Endpoint logs | Processes, file changes, and security events on a host |
| OS security logs | Logins, privilege use, account changes |
| IPS/IDS logs | Which attack signatures matched |
| Network logs | Switch, router, DHCP, DNS activity |
| Metadata | Data about data: email headers, file timestamps, authors |
Other data sources
Vulnerability scans show which weaknesses existed on a host at the time. Automated reports and dashboards summarize trends. Packet captures record full traffic content and are the most detailed, but they're large and short-lived.
Key terms
- Firewall logs
- Records of connections a firewall allowed or blocked, with addresses, ports, and times.
- Application logs
- Records an application writes about user actions, errors, and events inside it.
- Endpoint logs
- Records from a host about processes, file changes, and security events.
- OS security logs
- Operating system records of logins, privilege use, and account changes.
- IPS/IDS logs
- Records of traffic that matched intrusion signatures or anomaly rules.
- Metadata
- Data that describes other data, such as email headers or file creation times.
- Packet capture
- A recording of full network traffic, including payloads, for detailed analysis.
- Vulnerability scan data
- Results showing which weaknesses existed on systems at a point in time.
- Dashboards
- Visual summaries of security data that show trends and status at a glance.
- DNS logs
- Records of domain name queries made by clients on the network.
Check yourself
20 practice questions on this objective
Practice this objectiveFlashcards for this objective