NESQ

Cybersecurity practice

Reconstruct communications, access, and movement across the network.

Analyze firewalls, VPNs, DNS, proxies, NetFlow, and available traffic to investigate compromises, lateral movements, and exfiltration.

The network connects events that appear isolated on individual systems.

Network forensics uses logs and traffic data to reconstruct connections, authentication, communications towards suspicious infrastructures and transfers. The depth of the analysis depends on the available telemetry, retention and correct time synchronization.

Analyzable sources

  • firewalls, IDS/IPS and filtering systems;
  • VPN, remote access and identity providers;
  • DNS, proxy, secure web gateway and mail;
  • NetFlow, packet capture and network sensors;
  • cloud logs, balancers, WAFs and applications;
  • EDR/XDR and SIEM for endpoint correlation.

Activities

Time references are normalized, IPs, hosts, users and sessions are correlated, indicators are searched for and communication patterns are analyzed. Particular attention is paid to rare connections, beaconing, anomalous transfers and movements between segments.

Output

  • timeline of relevant communications;
  • map of sources, destinations and systems involved;
  • reusable indicators and queries for threat hunting;
  • evaluation of visibility limits;
  • recommendations on logging, segmentation and detection.