Tools of the Trade – Incident Response, Part 1: Log Analysis

• Log files
• Memory images
• Disk images

• OSSEC(3)
• log2timeline(6)

(1) BYO-IR: Build Your Own Incident Response: http://www.slideshare.net/wremes/isc2-byo-ir (2) http://computer-forensics.sans.org/community/downloads (3) http://www.ossec.net (4) e.g. APT1 Indicators of Compromise @ http://intelreport.mandiant.com/ (5) http://blog.commandlinekungfu.com/ (6) http://log2timeline.net/

• APT forensics
• critical infrastructure
• energy
• Financial Services
• hack incident response
• hacking attacks
• hacking incident
• Healthcare
• Manufacturing
• Media and Entertainment
• wim remes