CoreQ Academy4.9 Given a scenario, use data sources to support an investigation.
Investigations are built from evidence. Know which source answers which question: firewall logs for connections, endpoint logs for processes, packet captures for content.
Log data
- Firewall logs
- Allowed and blocked connections: source, destination, port, time.
- Application logs
- Events recorded by applications: logins, errors, transactions.
- Endpoint logs
- Activity on hosts: processes, file changes, USB use (from OS logs and EDR).
- OS-specific security logs
- Windows Security event log, Linux auth.log/secure, macOS unified log.
- IPS/IDS logs
- Detected and blocked attack signatures.
- Network logs
- Router, switch, DNS, DHCP and proxy logs.
- Metadata
- Data about data: email headers, file timestamps and authors, photo GPS tags. Often reveals the who, when and where.
Data sources
- Vulnerability scans
- Show which weaknesses existed and may have been exploited.
- Automated reports
- Scheduled summaries from tools.
- Dashboards
- Real-time visual views of security status.
- Packet captures
- Full copies of network traffic (PCAP) for deep analysis; large and short-lived.
Hands-on practice
Check your understanding
Knowledge quiz · pass mark 80%
- To find who failed to SSH into a Linux server, check:
- Email headers showing the true sending server are an example of:
- Which source shows the full content of a suspicious network conversation?
Original CoreQ Academy material, mapped to objective 4.9 of the publicly available CompTIA Security+ SY0-701 exam objectives (Exam objectives V7, document version 7.0). Not affiliated with or endorsed by CompTIA. Contains no exam questions.