Data Sources for Investigation
Given a scenario, use data sources to support an investigation
What you will learn
- Match each investigative question to the data source that answers it.
- Know what each log contains and what it does not.
- Explain the value of metadata and packet capture, and when each is needed.
- Understand why synchronised time is a precondition for any investigation.
An investigation is a series of questions, each with a source that answers it. "Who logged in?" the identity log. "Where did it connect?" the firewall log or network flow. "What did it run?" the endpoint log. "What exactly moved?" packet capture. Whoever collects everything without a question drowns; whoever asks first knows where to look.
Logs and their sources
| Firewall logs | Who connected to whom, when, and whether it was allowed or blocked. No content. |
|---|---|
| OS / security logs | Logons, logoffs, account creation, permission changes — the system's own events. |
| Endpoint logs | Which processes ran, what they created, what they changed. The closest source to "what the attacker actually did". |
| Application logs | Application events: who opened which record, which query ran. |
| IDS / IPS logs | What matched a signature or suspicious behaviour, and whether it was blocked. |
| Metadata | Data about data: a message's sender, timing and path, or a file's author and dates. |
| Packet capture | Full packets including content. The most precise and the heaviest to store, so it is rarely kept long. |
Flow data vs packet capture
| Flow data | Packet capture | |
|---|---|---|
| Content | Not included | Complete |
| Size | Small — kept for months | Enormous — hours or days |
| Answers | Who talked to whom, how much, when | Exactly what they said |
Without synchronised time there is no sequence
An investigation builds a timeline from multiple sources. If the firewall is four minutes fast and the endpoint an hour slow, events land in the wrong order — and it looks as though the file left before the attacker arrived. Time synchronisation over NTP is not an operational detail: it is the precondition for logs to mean anything together.
Real-world example: four questions, four sources
A report says customer data has surfaced outside the company. First question: who accessed it? The application log shows a sales account opened 3,400 customer records in one night. Second: is that normal for this account? User behaviour analytics says no — its average is twelve records a day. Third: where did it go? Network flow shows 240 MB uploaded to a personal storage service at the same time. Fourth: how did they get in? The identity log shows a successful login from an address in another country four minutes earlier. Four sources, each answering a question none of the others can — and the story only completes with all of them together.
What matters on the exam
- Read the question, then pick the source: "who logged in" identity, "where to" firewall or flow, "what ran" endpoint.
- Only packet capture gives content. If the question asks "exactly what data left", that is the answer.
- Missing time synchronisation ruins the timeline. If a question mentions events in a contradictory order, look for NTP.
- Metadata is usually sufficient and far cheaper. Do not choose packet capture for a question flow data answers.
Quick check
Answer in your head first, then reveal.
You need to know whether a specific file left the network and what was in it. Which source?Reveal the answer
Packet capture — only it contains content. Flow data tells you 240 MB went somewhere; it does not tell you what.
Why is time synchronisation a precondition for investigation?Reveal the answer
Because an investigation orders events from many sources into one timeline. Clock differences invert that order and the story is built wrongly — an effect can appear to precede its cause.
Which source answers "what processes did the attacker run on the host"?Reveal the answer
The endpoint logs — or EDR. The firewall sees connections, not what ran inside the host, and the OS log sees its own events, not every process.
Sign in to track your progress on this topic.
Your next step
Read the lesson, then mark it complete
Sources
Used to verify the facts. The writing is original to Passuit.