# Correlating Network and Host Logs for Attack Attribution
> Learn how to bridge the gap between traffic analysis and endpoint execution to improve incident response and cyber attack attribution.

Tags: cybersecurity, forensics, network-security, incident-response, siem, threat-detection, sysmon, log-analysis
## Correlation of Network and Host Logs for Attack Attribution
* Overview of bridging traffic analysis and endpoint execution for forensics.

## The Visibility Silo Problem
* Discusses the fragmentation between network analysts and endpoint analysts.
* Attribution requires connecting traffic ('what') to process/user ('who').

## Critical Network Artifacts
* NetFlow/IPFIX (Metadata: Source/Dest IP, Ports).
* Firewall Logs (Allow/Deny decisions).
* DNS Queries (C2 domains, tunneling).
* Proxy/Gateway Logs (HTTP methods, URLs).

## Critical Host Artifacts
* Process Creation (Event ID 4688).
* Network Connections (Sysmon ID 3).
* Authentication Logs (4624/4625).
* PowerShell Script Blocks (4104).

## Incident Response Principles
* Quote: "Logs are the memory of the network... Only together do you see the story."

## The Pivot Points
* Common keys for joining datasets: The '5-Tuple' (Src IP, Dst IP, Src Port, Dst Port, Protocol) + Timestamp.
* Role of Sysmon ID 3 in mapping process images to connections.

## Impact on Breach Lifecycle
* Log correlation reduces Mean Time to Identify (MTTI) and Contain (MTTC).
* Example: Duration drops from 322 days to 214 days with correlation.

## Scenario: C2 Beaconing
* **Network View:** Internal host 10.1.5.9 beaconing to suspicious IP every 60s.
* **Host View:** `unknown_svc.exe` spawned by `explorer.exe` at same timestamps.
* **Result:** Attribution to account compromise rather than simple browsing.

## Challenges in Correlation
* Time Synchronization issues.
* Data Volume and Noise.
* Encryption (TLS 1.3) hiding payloads.
* NAT & Proxies masking source IPs.

## Conclusion: Context is King
* Reconstructing the attack narrative leads to faster remediation and legally defensible attribution.
---
This presentation was created with [Bobr AI](https://bobr.ai) — an AI presentation generator.