Đang chuẩn bị liên kết để tải về tài liệu:
The Introduction to Logfile Analysis

It is important to understand that upon detection of a suspicious event (alarm), the Incident Handling machine must jump into high gear. An analyst's first step is to analyze the attack scenario and the motive behind it. One cannot rush immediately into thinking they are under attack before using other correlating data. | Introduction to Logfile Analysis Guy Bruneau GCIA Part 2 This module is an introduction to log analysis using real true-life examples Introduction to Log File Analysis - SANS GIAC LevelTwo 2001 1 Greetings I am Guy Bruneau. Today s talk will be on Introduction to Logfile Analysis . I would like to thank the SANS Institute for this opportunity to share some of my experience and knowledge in this sometimes difficult area. In this module we are going to work with a case stressing the importance of data correlation to piece together the intent of a probe. For those who are not familiar with incident handling here are the six stages of incident response Preparation Detection Containment Eradication Recovery Follow-up Throughout this module we are going to be dealing with the second stage Detection Copyright Guy Bruneau 2000-2001. All rights reserved. 1 Outline References Objectives Tips - Practical Analysis A practical case Three practical exercises Review Quiz Software links Introduction to Log File Analysis - SANS GIAC LevelTwo 2001 2 These are the things we re going to cover in the second module. In essence we re going to take some logs and act as the incident handler on duty. If you work within a Computer Incident Response Team or as an Intrusion Detection analyst it is very important to understand the logs you are working with. It is important to understand that upon detection of a suspicious event alarm the Incident Handling machine must jump into high gear. An analyst s first step is to analyze the attack scenario and the motive behind it. One cannot rush immediately into thinking they are under attack before using other correlating data. 2 References 1 Book - W. Richard Stevens TCP IP Illustrated Vol. 1 Addison Wesley 1994. Trojan Ports Lists - http www.sans.org y2k ports.htm - http www.simovits.com nyheter9902.html - http doshelp.com trojanports.htm - http www.xploiter.com security trojanport.html - http www.tlsecurity.net troj anh.htm Introduction to Log File