domains / families / security / incident-response-network

incident-response-network

separate

Network forensics evidence collection and analysis during security incidents. Guides volatile evidence preservation, lateral movement detection via flow records and ARP/MAC/CAM table analysis, and read-only containment verification across Cisco IOS-XE/NX-OS, Juniper JunOS, and Arista EOS. Scoped to network artifacts only — packet captures, flow data (NetFlow/sFlow/IPFIX), forwarding tables, routing state, and device logs. Not general incident response, endpoint forensics, or malware analysis.

When to use

• **Active security incident** requiring network-level evidence collection
• **Post-incident network forensics** — reconstructing what happened on the
• **Lateral movement investigation** — tracing attacker movement between
• **Unauthorized access investigation** — identifying how an external or
• **Data exfiltration analysis** — quantifying outbound data transfers via
• **Containment verification** — confirming (read-only) that ACLs, null

When not to use

• General incident response
• Endpoint forensics
• Malware analysis
• Organizational communication plans

Skill page

Source