Data sources

This objective focuses on your ability to act as a digital detective. In a security incident, attackers will lie or hide, but the data sources don’t lie. CompTIA will present a scenario, such as an unexplained server crash, a suspected data breach, or a user account behaving oddly, and you must select the precise log type or data source that contains the evidence needed to solve the case.

1. Analyzing Log Data

When investigating a scenario, look to specific log types depending on which layer of the infrastructure the incident touched.

Network & Perimeter Logs

• Firewall Logs: Record traffic attempting to cross network boundaries based on IP addresses and ports.
  • Investigation Focus: Use these to prove network connections. If you need to confirm whether an internal compromised workstation successfully established an outbound connection to a specific malicious external Command-and-Control (C2) IP address, the firewall log will show a PERMIT or DENY record with a timestamp.
• IPS/IDS Logs: Record matches against known malicious signatures or sharp behavioral anomalies.
  • Investigation Focus: Use these to identify the intent and type of attack. If an external actor is running a script to exploit a known vulnerability against your web server, the IPS log will pinpoint the exact CVE being targeted and whether the packet was dropped.
• Network Logs: Router and switch event logs that track internal routing changes, interface states, and protocol adjustments.

Endpoint & OS-Specific Security Logs

• OS-Specific Security Logs: Centralized operating system authentication and event logs (e.g., the Windows Security Event Log or /var/log/auth.log in Linux).
  • Investigation Focus: Use these to track user activity and authentication. Look here to diagnose password attacks (brute-forcing vs. password spraying by analyzing failed login counts), unauthorized privilege escalations (tracking sudo execution or administrative group additions), and account lockouts.
• Endpoint Logs: Local logs generated by security agents running directly on the host, such as Next-Gen Antivirus (NGAV), Sysmon, or Endpoint Detection and Response (EDR) platforms.
  • Investigation Focus: Use these to track the execution of local processes. If an employee clicks a bad link, the endpoint log will show the exact chain of execution (e.g., outlook.exe spawned word.exe, which then spawned powershell.exe to download a malicious payload).

Application Logs & Metadata

• Application Logs: Event streams generated directly by running software packages (e.g., Apache/Nginx web server access logs, or database transaction history).
  • Investigation Focus: Use these to track software exploitation. If an attacker is targeting a web application, the application access logs will show the explicit HTTP GET/POST request strings, exposing SQL Injection (SQLi) patterns or Directory Traversal (../) attempts.
• Metadata: Structural data about data, rather than the data itself.
  • Network Metadata (NetFlow): Tracks flow summaries (Source IP, Destination IP, ports, timestamps, and total byte size). If you suspect data exfiltration but don’t have full packet captures, NetFlow metadata can show that 50 Gigabytes of data was transferred from a local file server to an external IP at 2:00 AM.
  • File Metadata: Tracks author profiles, creation dates, camera geolocation data, and modification histories embedded inside standard files.

2. Utilizing Data Sources

Beyond raw text logs, investigations rely on structured data platforms, compliance reports, and deep network captures to build a timeline of events.

• Packet Captures (PCAPs): The gold standard of network evidence. A PCAP records the entire physical data payload as it crosses the wire.
  • Investigation Focus: While a firewall log tells you who talked to whom, a packet capture lets you fully reconstruct the conversation. Forensics analysts can open a PCAP file in a tool like Wireshark to carve out and rebuild an exact copy of a malware file as it transited the network, or read unencrypted clear-text passwords straight out of an insecure session.
• Vulnerability Scans: Historical reports that show exactly which security flaws, unpatched software, or misconfigurations existed on a system prior to the attack.
  • Investigation Focus: Cross-reference these during post-incident analysis to determine the exact entry path an attacker used. If an external server was breached, checking the most recent vulnerability scan can determine whether it was running an unpatched service with a known Critical CVE.
• Automated Reports: Standardized, scheduled summaries generated by security systems (such as daily Active Directory compliance reports, cloud configuration audits, or email gateway block statistics) used to establish historical baselines.
• Dashboards: Centralized, real-time graphical visualization interfaces fed by SIEM engines. Dashboards compile thousands of disparate log lines into high-level charts, allowing investigators to instantly spot sudden spikes in outbound bandwidth consumption, concurrent-session anomalies, or waves of geographic “impossible travel” logins.

Quick Investigation Reference Table

When faced with a scenario question on the exam, match the investigative goal to the optimal data source:

If you need to investigate…	…Look directly at this Data Source:
Outbound traffic to a known bad IP	Firewall Logs
The exact contents or files inside unencrypted network traffic	Packet Captures (PCAPs)
Excessive failed login attempts or unauthorized administrative commands	OS-Specific Security Logs
Web injection attempts or directory manipulation strings	Application Logs
The volumetric size of data transferred without checking payloads	Metadata / NetFlow
The malicious process execution tree on a workstation	Endpoint Logs / EDR