SECURITY 558SECURITY 558


Course PDF

Active evidence acquisition is the focus of day three. We'll analyze IDS/IPS, central logging servers, and Web proxies such as Squid during hands-on exercises throughout the day. By the end of day three, students will be using hex editors to carve cached evidence out of Web proxies, and reconstruct Web surfing histories using only the central Web proxy logs.




  • Topics - Day 3:
    • Network Log analysis in depth
      • Centralized logging with syslog and syslog-ng
      • OS and authentication logs
      • Using Splunk for aggregation and correlation
    • Network intrusion detection and analysis with Snort
    • Web proxies, encryption, and SSL interception
      • Analyzing Web access histories (using Squid)
      • Web cache page reconstruction (using Squid)
SECURITY 558 Upcoming Events
Event Location Dates Delivery Method
Community SANS Forensics DC 2010Alexandria, VAFeb 22, 2010 - Feb 26, 2010Community SANS
SANS 2010Orlando, FLMar 06, 2010 - Mar 15, 2010Live Event
"This is awsome! We're seeing details that most people don't even know exist" - John Wright, Info Tech, Inc.
"The class provided in-depth, real world, hands-on information" - Robert Dale Drollinger, General Dynamics
SANS Institute