domains / families / security / performing-log-analysis-for-forensic-investigation

performing-log-analysis-for-forensic-investigation

separate

Collect, parse, and correlate system, application, and security logs

When to use

• When reconstructing the timeline of a security incident from available log sources
• During post-breach investigation to identify initial access, lateral movement, and exfiltration
• When correlating events across multiple systems and log sources
• For establishing evidence of unauthorized access or policy violations
• When preparing forensic reports requiring detailed event chronology

Skill page

Source