Security Operations · Topic 14 of 14
Investigation Data, Artifacts and Sources
Security+ investigation data: log and trace types, NetFlow and IPFIX, packet captures, log integrity, memory dumps, bit-level copies and log parsing.
- 5 min
- Access and accounting logs are logical or physical.
- Know the log types: device, server, application, authentication, communication, audit, endpoint, network and metadata.
- Packet captures hold content. NetFlow and IPFIX hold summaries.
What it is
A security investigation depends on evidence: logs, traces, captures and images of systems. The investigator must know which source answers which question and how to keep the evidence trustworthy.
This page covers the log and trace data types, other data sources, file and log integrity, system images, the stakeholders who take part, and log-parsing techniques.
How it works
Log and trace data types
| Type | What it shows |
|---|---|
| Access and accounting: logical | Sign ins to systems and applications, and what each account did |
| Access and accounting: physical | Badge readers, door logs and visitor records |
| Device | Events from network devices, appliances and other hardware |
| Server | Operating system security events, services, errors and privilege use |
| Application | Application events, errors and user actions |
| Authentication | Successful and failed sign ins, MFA results and lockouts |
| Communication | Email, chat and call records, such as who contacted whom and when |
| Audit | Records of administrative and policy changes, kept for accountability |
| Endpoint | Process, file and registry activity on a device, often from an EDR agent |
| Network | Firewall, proxy, router and switch traffic records |
| Metadata | Data about data, such as file author, creation time or email headers |
Correlating several types gives a fuller story. A badge log shows someone entered the building, an authentication log shows a sign in at a desk, and a network log shows a large upload a minute later.
Data sources
| Source | Use |
|---|---|
| Vulnerability scans | Show weaknesses that may explain how an attacker got in |
| Automated reports | Regular summaries of activity and events |
| NetFlow and Internet Protocol Flow Information Export (IPFIX) | Summary records of network conversations, without content |
| Surveillance footage | Video of physical areas, showing who was present |
| Security tools | Alerts and records from tools such as EDR, intrusion detection and data loss prevention |
| Dashboards | Live view of key measures from a security information and event management (SIEM) system |
| Packet captures | Full copies of network traffic, including content, for detailed analysis |
A packet capture shows the content of traffic, while NetFlow shows only summaries. Packet captures are large, so they are often kept for short periods or taken only when needed.
File and log integrity
Evidence is only useful if it can be shown to be unchanged. Hashing records a fingerprint of a file or image, and a matching hash later proves nothing changed. File integrity monitoring alerts when important files change.
Logs should be forwarded to a central store with restricted access, so an attacker on a host cannot edit or erase them. Accurate, synchronized time stamps are needed to put events in order.
System image
| Image type | What it captures |
|---|---|
| Memory dump | The contents of RAM: running processes, network connections, encryption keys and malware that never touches disk |
| Bit-level copy | An exact copy of every bit on a drive, including deleted files and unused space |
| Snapshot | A point in time copy of a virtual machine or cloud volume |
Memory is lost when power is removed, so it is captured before a system is shut down. Analysts work on a verified copy, not the original, and compare hashes to show that the copy matches. A write blocker prevents changes to the original drive while it is copied.
Stakeholders
| Stakeholder | Role in an investigation |
|---|---|
| Human Resources (HR) | Involved when an employee is a subject, for interviews, discipline and employment records |
| Accounts | The finance and accounting team, who help trace fraud, payments and financial impact |
| Legal | Advises on evidence, privacy, regulators, law enforcement and legal holds |
Each stakeholder should see only the evidence they need, and contact goes through the incident lead.
Log-parsing techniques
Logs are large and come in many formats. Parsing turns them into fields that can be searched and counted.
| Technique | Use |
|---|---|
| Filtering | Keep only relevant events, such as one user, one host or one time window |
| Pattern matching | Use search strings or regular expressions to find values such as addresses |
| Field extraction and normalization | Split each line into named fields in one common format |
| Sorting and counting | Find top sources, rare events and spikes |
| Timeline building | Merge events from all sources in time order |
How the exam asks about this
- "Prove which employee entered the server room at 2 a.m." -> Physical access logs and surveillance footage.
- "Find malware that runs only in memory." -> A memory dump taken before shutdown.
- "Show that the forensic copy matches the original drive." -> Compare hashes of the bit-level copy and the original.
What to remember for the exam
- Access and accounting logs are logical or physical.
- Know the log types: device, server, application, authentication, communication, audit, endpoint, network and metadata.
- Packet captures hold content. NetFlow and IPFIX hold summaries.
- Surveillance footage and badge logs support physical investigations.
- Hashes and central, protected log stores keep evidence trustworthy.
- A memory dump captures RAM, a bit-level copy captures a whole drive, and a snapshot captures a virtual machine state.
- HR, accounts and legal are investigation stakeholders.
- Log parsing filters, extracts, counts and orders events into a timeline.
When a question asks what to do first with a running compromised machine, think about capturing memory before shutdown.
Common mistakes
Investigating on the original disk. Examine a verified copy so the original remains unchanged.
Taking a normal file copy as a forensic image. Only a bit-level copy includes deleted files and unused space.
Relying on one log source. One log shows only part of the picture.
Forgetting about time zones. Logs from systems in different zones or with wrong clocks give a wrong sequence.
Leaving HR and legal out. Investigations of staff need them from the start.
Deleting or reimaging a system before evidence is collected can destroy the proof and make the incident impossible to understand.
Check yourself
What does a bit-level copy include that a file copy does not?
Every bit on the drive, including deleted files and unused space.
Why is a memory dump taken before shutdown?
RAM is lost when power is removed, along with running processes and memory-only malware.
What is the difference between a packet capture and NetFlow?
A packet capture keeps full traffic including content, while NetFlow keeps only summary information about each flow.
Topic 14 of 14 in Security Operations
Test yourself on Security Operations
The full CompTIA Security+ SY0-801 question bank has 998 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.