Tools, Systems and Programs · Topic 6 of 6
Log, Social Media, Insider Threat and Blockchain Tools
Learn network log and traffic tools, social media forensics, insider threat tools, IIS and Apache log analyzers, blockchain and AWS forensic tools.
- 5 min
- Splunk, Elastic and Graylog index logs. Log Parser Studio queries IIS logs.
- Zeek and NetFlow summarize traffic. Wireshark shows packets.
- Social media evidence needs authentication: capture URL, time and hash.
What it is
This page covers analysis tools for logs and online activity: network logs, traffic, social media, insider activity, web server logs, blockchain transactions and AWS. The question is usually the same: which tool turns this data source into an answer.
How it works
Network log analysis tools
Firewall, router, proxy, DNS and VPN logs are searched with log platforms and command line tools.
| Tool | Use |
|---|---|
| Splunk, Elastic stack, Graylog | Index and search large logs |
| Log Parser and Log Parser Studio | SQL style queries over Windows, IIS and text logs |
| nfdump and NetFlow analyzers | Flow data: who talked to whom, how much |
| grep, awk, sort, uniq | Quick filtering and counting |
| Zeek logs | conn.log, dns.log, http.log from captured traffic |
Look for unusual destinations, large outbound transfers, repeated denies, DNS queries to odd domains and activity at unusual hours.
Tools for investigating network traffic
Wireshark, tshark and tcpdump capture and analyze packets. NetworkMiner and Xplico rebuild files and sessions. Useful checks: top talkers, protocol hierarchy, DNS requests, follow TCP stream and exported objects.
tshark -r capture.pcap -Y "dns" -T fields -e frame.time -e ip.src -e dns.qry.nameThis lists time, source and queried name for each DNS packet.
Social media forensic tools
Social media evidence is mostly public posts, profile data and the platform's records. Collect it so it can be authenticated.
| Task | Tools and methods |
|---|---|
| Capture web pages with hash and timestamp | Hunchly, browser capture tools |
| Link analysis and OSINT | Maltego, SpiderFoot |
| Platform data exports | Account export provided by the user, or by the platform on legal request |
| Mobile app data | Mobile forensic suites that parse the app databases |
| Cloud and social account acquisition | Magnet AXIOM and similar tools, with credentials the user supplied or the court allowed |
A preservation request to the platform asks it to keep records while legal process is prepared. Capture URL, account name, date and time, and a screenshot or saved page with a hash. Respect terms and laws: do not log in with credentials you are not authorized to use.
Insider threat tools
Insider investigations look at authorized users acting outside their role.
| Tool class | Examples | Detects |
|---|---|---|
| Data loss prevention | Microsoft Purview, Forcepoint, Digital Guardian | Copying or sending sensitive files |
| User and entity behavior analytics | Exabeam, Securonix | Behavior that deviates from a baseline |
| User activity monitoring | Teramind, Ekran System, Proofpoint ITM | Screens, keystrokes, file and app use |
| SIEM | Splunk, Sentinel, QRadar | Correlated logs |
Typical evidence: USB use, large downloads, cloud uploads, email to personal accounts, print jobs, access outside normal hours and attempts to reach files outside the role. Monitoring must follow policy and law, including employee notice.
Tools for analyzing IIS and Apache logs
IIS W3C logs and Apache access logs are text. Log Parser Studio runs SQL queries on IIS logs. GoAccess, AWStats and WebLog Expert summarize traffic. grep, awk and a SIEM work on both.
goaccess access.log --log-format=COMBINEDTypical questions: top client addresses, most requested URLs, counts of each status code, requests with unusual user agents and bursts of errors at a given time.
Blockchain forensic tools
Blockchains such as Bitcoin and Ethereum are public ledgers. Addresses are pseudonymous, not anonymous. Investigators trace the flow of funds across addresses with blockchain explorers (such as Blockchair, Etherscan) and commercial analytics tools: Chainalysis, Elliptic, TRM Labs and Crystal Intelligence (formerly Crystal Blockchain).
Techniques: address clustering (addresses likely to be controlled by one entity), transaction graph tracing, identifying exchange deposits and mixing services, and linking wallets to real people through exchange records obtained by legal process. Wallet files and seed phrases on seized devices are evidence and are handled like keys.
AWS forensic tools
| Tool or service | Use |
|---|---|
| CloudTrail | API activity log, with CloudTrail Lake for queries |
| CloudWatch Logs | Application and system logs |
| VPC Flow Logs | Network traffic metadata |
| GuardDuty | Threat findings |
| Amazon Detective | Investigation of related activity |
| Athena | SQL queries over logs stored in S3 |
| EBS snapshots | Disk copies of an instance |
| Systems Manager | Run commands on instances for live collection |
| AWS CLI | Scripted collection |
Typical steps: isolate the instance with a restrictive security group (do not terminate it), snapshot its volumes, capture memory if possible, copy snapshots to a forensic account, and preserve CloudTrail logs.
aws ec2 describe-snapshots --owner-ids selfA worked example
A departing employee is suspected of copying files. A DLP alert shows a large upload to a personal cloud service, and proxy logs confirm the destination and time.
The investigator hashes the logs, checks USB records on the laptop, and ties the activity to the user account with authentication logs.
How the exam asks about this
- "Which tool captures web pages with a hash and timestamp?" → Hunchly.
- "Which technique groups blockchain addresses likely owned by one entity?" → Address clustering.
- "Which AWS service holds API call history?" → CloudTrail.
What to remember for the exam
- Splunk, Elastic and Graylog index logs. Log Parser Studio queries IIS logs.
- Zeek and NetFlow summarize traffic. Wireshark shows packets.
- Social media evidence needs authentication: capture URL, time and hash.
- Insider threat tools: DLP, UEBA and user activity monitoring.
- Blockchain addresses are pseudonymous. Exchange records link them to people.
Do not use a suspect's credentials to log in to their social media or cloud account without legal authority.
Common mistakes
Calling Bitcoin anonymous. It is pseudonymous, and the ledger is public.
Terminating a compromised cloud instance. That loses memory and may destroy volatile evidence. Isolate and snapshot.
Monitoring employees without a policy. Evidence may be challenged and the monitoring may be unlawful.
Check yourself
What is address clustering?
Grouping blockchain addresses that are likely controlled by the same entity, based on transaction patterns.
Which tool runs SQL like queries on IIS logs?
Log Parser, or Log Parser Studio.
What is the first step for a compromised AWS instance?
Isolate it, for example with a restrictive security group, and snapshot its volumes without terminating it.
Topic 6 of 6 in Tools, Systems and Programs
Test yourself on Tools, Systems and Programs
The full EC-Council 312-49 question bank has 900 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.