The "Art" Of Log Correlation - Tools And Techniques For Correlating Events And Log Files

Log file correlation is related to two distinct activities: Intrusion Detection and Network Forensics. It is more important than ever that these two disciplines work together in a mutualistic relationship in order to avoid Points of Failure. This paper, intended as a tutorial for those dealing with such issues, presents an overview of log analysis and correlation, with special emphasis on the tools and techniques for managing them within a network forensics context. In particular it will cover the most important parts of Log Analysis and correlation, starting from the Acquisition Process until the analysis.