Situational awareness during an attack is crucial to minimizing the malicious effects. The use of Netflow data is a simple and often under utilized technique for gaining visibility. This talk will focus on using flow data as a tool to facilitate incident response as well as network forensics. We will explore what Netflow is, how to setup the collection of flows, how Netflow can be integrated into existing incident response workflows, and give various examples.

Download:
http://archive.org/download/BsidesCleveland2012Bsidescle/7NetflowForIncidentResponse-JamisonBudacki.avi

Back to Bsides Cleveland 2012 video list