Utilize appropriate data sources to support an investigation

Check Vulnerability scan output

SIEM dashboards

• Sensor

• Sensitivity

• Trends

• Alerts

• Correlation

Log files

• Network

• System

• Application

• Security

• Web

• DNS

• Authentication

• Dump files

• VoIP and call managers

• Session Initiation Protocol (SIP) traffic

• syslog/rsyslog/syslog-ng

Check Bandwidth monitors

Metadata

• Email

• Mobile

• Web

• File

Netflow/sFlow

Netflow

sFlow

IPFIX

Protocol analyzer output