In Chapter 3, Computer Forensics and Evidence Handling, we looked at the idea of threat actor attribution. In this section, we look more specifically at how we can utilize network (DNS and HTTP logs) and threat intelligence data to find a threat actor. This is specifically referenced in topics 4.7 and 4.8 in the 210-255 specification:
Implementing Cisco Cybersecurity Operations (210-255) Topic List:
4.7 Map DNS logs and HTTP logs together to find a threat actor
4.8 Map DNS, HTTP, and threat intelligence data together
4.7 Map DNS logs and HTTP logs together to find a threat actor
4.8 Map DNS, HTTP, and threat intelligence data together
DNS and HTTP services are fundamental to many network applications, particularly those that operate over the internet. This means that they are services that very close to 100% of organizations will have permitted on their networks. For an attacker, this means that the likelihood of data successfully traversing the trusted/untrusted boundary...
