Logs and Data Sources for Investigations

Glossary

214 terms from Logs and Data Sources for Investigations, in plain words, each with the chapter that teaches it.

Search the glossary

A

Account lockout: An account being blocked after too many failed sign-ins. Brute force often triggers a lockout, but password spraying stays under the limit on purpose, so a log with no lockouts doesn't prove nothing happened.
Accounts (stakeholder): The team that handles the company's money. You bring them in when an incident involves payments, invoices, bank details or costs, as when the attacker emailed a café fake bank details for paying invoices.
AIDE: A file integrity monitoring tool. It keeps hashes of important files and sends an alert when one of them changes.
Alert: A notice that fires in real time when a single event matches a rule, so someone can act on it. An example is Alex's SIEM alert for an SSH sign-in from outside the office.
Analyzer: The part of a flow-record system that searches and graphs the flow records stored by the collector.
Antivirus: Software that checks files against signatures of known bad files and can quarantine the ones that match. It misses new tools until someone writes a signature for them.
Application log: The record a program writes about its own work, such as orders, gift card checks and errors. It can show attacks that look normal to the web server, like the guessing of gift card codes at the Kettle & Crane shop.
ARP (Address Resolution Protocol) cache: A short-lived table in memory that maps IP addresses to MAC addresses on the local network. It ranks high in the order of volatility, so it must be collected early.
Attorney-client privilege: A legal protection that can stop an investigation's findings from being handed to the other side in a lawsuit. It applies when legal directs the work.
Audit log: A record of security-relevant actions, such as reading a sensitive file, changing a setting or clearing a log, with each action tied to the account that did it. It showed that Sam's account copied the customer file.
auditctl: The Linux command that adds rules to the audit system. Alex used it to watch reads of /srv/shop/exports/customers.csv: -w names the file, -p r records reads and -k tags each record with a key.
auditd: The Linux audit system. It records the events its rules ask for, such as each read of a sensitive file.
auid (audit user ID): The field in an audit record that names the account that first signed in. It stays the same even if the person later switches accounts, so auid=sam points back to the original sign-in.
ausearch: The Linux command that searches audit records, for example by key with -k custdata. The -i option turns numbers into readable names.
Authentication log: A record of every attempt to prove an identity: who tried, from where, with which method, and whether it worked. On Linux, SSH writes to /var/log/auth.log.
Authentication-Results: An email header added by a mail server that checks SPF, DKIM and DMARC. It records each result, such as spf=pass dkim=fail dmarc=fail.
Automated report: A summary that a tool produces on a schedule or when something triggers it, with no one asking, such as a daily Logwatch summary. Reports give you a baseline and history, but they are too late to work as alerts.
awk: A Linux command-line tool that splits each line into numbered fields and prints the ones you ask for. $NF is the last field, and -F'"' splits the line at quote marks instead of spaces.
AWS CloudTrail: The audit log of administrative actions kept by Amazon Web Services (AWS).
Azure activity log: The audit log of administrative actions in Microsoft's Azure cloud.

B

Badge records: The record of which badge opened which door, and when. It proves a badge was used, but only footage shows who used it, so the two are paired.
Baseline: What normal activity looks like, so that unusual activity stands out. A month of daily reports showed that sam never signed in over SSH, so the attacker's sign-in was clearly abnormal.
Beacon: Many small connections at regular times to one address. In flow data, this pattern is a sign of malware checking in with its controller.
Bit-level copy: A copy of an entire storage device, every bit from first to last, including deleted files, unallocated space and slack space. Alex's bit-level copy of Casey's USB drive found deleted customer records.
Breach notification: The legal duty to tell affected people when certain data is stolen. Each US state has its own law, and legal decides which laws apply and what the notices say.
Brute force: An attack that tries many passwords against one account. It often ends in an account lockout.

C

Call detail record (CDR): The record a phone system keeps for each call: caller, number called, start time and length, but not the conversation.
Capture filter: A filter that decides which packets get saved in the first place, such as tcpdump's port 8080. Anything it leaves out is gone for good, so investigators capture broadly.
Central log collection: Sending logs to a SIEM or log server as they are written. An attacker who controls one server can edit its local log, but not the copy already sent away.
Chain of custody: The record of who held a piece of evidence and when. Alex writes each evidence file's hash in it, such as the hash of the exported camera clip.
ClamAV: A free antivirus scanner. Alex added the attacker tool's SHA-256 hash to it as a custom signature, and the scan found /tmp/.sync on the shop server; ClamAV marks signatures you write yourself as UNOFFICIAL.
Clock offset: The difference between a device's clock and the real time, such as camera 2 running 2 minutes behind. Measure it and correct for it, along with the time zone, before comparing the device's times with logs.
Collector: The system that receives flow records from exporters and stores them. In the lab this was nfcapd; IPFIX collectors listen on port 4739 by default.
Communication log: A record of messages between people, such as email, chat and calls, showing who contacted whom, when, and sometimes the content. Kettle & Crane's mail log showed that only Sam received the phishing email.
Core dump: A memory dump of a single program rather than the whole computer, like the one gcore made of the shop server's order-sync program.
Correlation: Linking events from different sources by something they share, such as an address, account, file name or time. The address 198.51.100.77 tied together the mail, firewall, web, authentication, DNS, IDS and flow evidence.
Crash dump: A memory dump that the operating system writes by itself when it crashes. It can hold the same kinds of evidence as other memory dumps.
Credential stuffing: An attack that tries many accounts once each, using a different password for each one that was stolen from another site. Password spraying, by contrast, uses the same common password on every account.
Credentialed scan: A vulnerability scan that signs in to each system, so it can see installed software and settings from the inside.
curl: A standard command-line tool that downloads and uploads files over the web. The attacker used it to fetch sync.sh and to upload the customer file.
CVE (Common Vulnerabilities and Exposures): The public ID number given to a known software flaw. A vulnerability scan reports it with each matching finding.
CVSS (Common Vulnerability Scoring System): A score from 0 to 10 that rates how severe a vulnerability is.

D

Dashboard: A live screen of charts and counts built from many sources, usually in the SIEM, that shows an attack's shape and scope at a glance. The raw events you drill down to are the real evidence.
Data breach: An incident in which protected data, such as customer records, is accessed or taken by someone who shouldn't have it. The packet capture confirmed the breach: 2,400 customers' names, emails and zip codes were sent to the attacker.
Data source: A place evidence comes from other than event logs, such as scan results, reports, flow records, footage and packet captures.
dc3dd: A Linux imaging tool for making bit-level copies of drives. It is a forensic version of dd.
dd: A Linux command that copies a device bit for bit. Alex used it to image Casey's USB drive, with if= for the input device, of= for the output file, and conv=noerror,sync to keep going past unreadable blocks.
Device log: A log about a device itself, such as configuration changes, administrator sign-ins and hardware. 'Admin changed the firewall rule set' is a device log entry; 'rule dropped traffic' is a network log entry.
DHCP (Dynamic Host Configuration Protocol): The protocol that hands out IP addresses. Its lease log records which device, by MAC address and host name, held each address and when.
Digital signature: A cryptographic signature over data. It proves the data is unchanged and also shows who produced it, which gives non-repudiation.
Display filter: A filter that only hides packets from view in a capture that is already saved, such as tshark's -Y http.request. Nothing is lost.
DKIM (DomainKeys Identified Mail): An email check in which the sending domain signs each message with a cryptographic key, so receiving servers can verify the domain and see that the message wasn't altered. Its result is recorded in the Authentication-Results header.
DLP (data loss prevention): A security tool that spots sensitive data, such as card numbers, leaving by email, upload or USB drive, and can block it.
DMARC: An email policy that uses SPF and DKIM results to check that the From domain is genuine, and tells receivers what to do with mail that fails. A pass proves only who owns the domain, so an attacker's lookalike domain can pass it.
DNS (Domain Name System): The system that turns names into IP addresses. A DNS query log lists which computer looked up which name and when, and it showed the shop server looking up files.cdn-sync.example.
dnsmasq: The small DNS service on the shop server. It logs each lookup, such as query[A], which asks for a name's IPv4 address.
Domain controller: The server that checks passwords for a Windows network. It records credential checks and account lockouts for the whole company.
Drilling down: Clicking a chart or bar on a dashboard to open the raw events behind it.
DumpIt: A Windows tool that copies a computer's whole memory to a file.

E

E01: A forensic image format that stores the hash and case notes together with the disk image.
EDR (endpoint detection and response): An agent program on each endpoint that records activity, such as programs started, their parents, command lines, files and connections, and can stop it. A central console lets you search every managed computer at once, for example for a file's hash.
Email headers: The metadata lines at the top of an email that record its route, the sending server's address, the time at each step and the sending program. In the Received line, trust the bracketed address your own server added.
Email security gateway: A security tool that rejects or quarantines incoming email it judges to be spam, phishing or malware.
Endpoint: A computer that people or programs use directly, such as a laptop, desktop, phone, tablet, or a server seen as a single machine.
Endpoint logs: Records of what happens inside a single computer: antivirus detections, EDR telemetry, host firewall events, USB devices and software installs.
ESMTP (Extended SMTP): The extended form of SMTP, the protocol that moves email between servers. It appears in the mail log and in the phishing email's Received header.
eve.json: Suricata's detailed event log. It holds one JSON record per line with named fields, which is the form a SIEM reads.
EXIF (Exchangeable Image File Format): Metadata that cameras store inside photos, such as camera model, time taken and often GPS location. It showed that Bloom Café's photo was taken in Portland, not Seattle.
ExifTool: A free tool that reads a photo's EXIF metadata.
Exporter: A device such as a router, switch or firewall that watches traffic, builds a flow record for each flow, and sends it to a collector. In the lab, softflowd was the exporter.

F

False negative: A real weakness or attack that a scan or tool missed.
False positive: A reported weakness that isn't really there, or an alert on harmless activity. Tuning the rule reduces them.
fast.log: Suricata's short alert log, with one line per alert showing the time, rule ID, message, classification, priority and addresses.
ffprobe: A free tool that reads a video file's details. Alex used it to get the camera clip's length and recorded start time.
File integrity monitoring (FIM): A tool that keeps hashes of important files and sends an alert when one of them changes.
File timestamps: The four times Linux keeps for each file: Birth (created), Modify (content last changed), Change (metadata last changed) and Access (last read). Investigators can update the access time just by looking, as Alex's own scan did on /tmp/.sync.
Fileless malware: Malware that runs only in memory and never saves a file to disk. Only a memory dump captures it.
Firewall log: A record of each connection a firewall allowed or blocked, with addresses, ports and flags. The shop server's KC-FW DROP lines revealed a port scan.
Flow: One conversation between two computers in one direction, with the same addresses, ports and protocol.
Flow record: A summary of a flow: addresses, ports, protocol, times, packets and bytes, but no content. A 128,583-byte flow to the attacker matched the size of the 127,784-byte customer file.
FTK Imager: A Windows tool for making forensic images of drives.

G

gcore: A Linux tool that dumps the memory of a single running program to a core file. Alex used it on the shop server's sync program, process 14771.
GPS (Global Positioning System): Satellite location data that phone cameras often save in a photo's EXIF metadata.
grep: A Linux command that keeps only the lines containing a pattern. -oE prints only the regex match, -c counts matches per file, -F treats the pattern as plain text, and -i ignores case.

H

Hash: A short fingerprint calculated from a file: the same file always gives the same hash, and changing one character gives a completely different one. A hash shows that something changed, but not what changed.
Hash chain: A way of protecting logs where each record's hash is linked to the one before it, so deleting a record breaks the chain.
Hibernation file: A Windows file on disk that holds memory saved when the computer hibernates, so pieces of memory can survive there.
Hidden file: On Linux, a file whose name starts with a dot, such as /tmp/.c or /tmp/.sync, which a normal file listing doesn't show. Attackers use hidden names to keep copied data and tools out of sight.
HMAC (hash-based message authentication code): A hash made with a secret key. Placed over logs, it proves both that they are unchanged and who produced them.
Host addresses (127.0.0.1, 0.0.0.0): 127.0.0.1 (localhost) is the address a computer uses to reach itself, so 'from 127.0.0.1' in the DNS log meant the shop server itself looked up the attacker's domain. 0.0.0.0 means 'every address on this machine' when a service listens on it, or 'no address yet'.
HR (Human Resources): The department that handles employment matters such as hiring, conduct, discipline and leaving. You bring HR in whenever an employee is a suspect, witness or victim, as with Casey's USB drive.
HTTP (Hypertext Transfer Protocol): The protocol of the web, used for page requests and file uploads.
HTTP status codes: The number a web server returns for each request: 200 OK (success), 400 bad request, 401 unauthorized (sign-in needed or failed) and 404 not found; codes 400 and above are errors. In the shop's access log the status code is field 9.
HTTPS: Web traffic protected by TLS. A capture of it shows addresses, sizes and times, but the content is scrambled.
Hypervisor: The software that runs virtual machines and keeps their snapshots. A snapshot taken through it while the VM is running can include memory.

I

Identity provider: The cloud service that runs single sign-on and MFA. It logs each sign-in and each MFA prompt.
IDS (intrusion detection system): A tool that watches network traffic and raises an alert when the traffic matches a rule. Suricata, an IDS, alerted on the upload from the shop server to the attacker.
IETF (Internet Engineering Task Force): The group that writes internet standards, which it publishes as numbered RFCs.
Impossible travel: A sign-in pattern where one account signs in from two places too far apart for the time between them.
Integrity: Proof that evidence hasn't changed since it was collected, shown with hashes, central log copies, write-once storage and file integrity monitoring. Encryption protects confidentiality, not integrity.
IP address: The number that identifies a computer on a network, such as the shop server's 192.0.2.10.
IPFIX (Internet Protocol Flow Information Export): The open standard for flow records that the IETF built from NetFlow version 9, published as RFC 7011. Its collectors listen on port 4739 by default.
IPS (intrusion prevention system): An intrusion detection system that can also block the traffic that matches its rules.
IPv4: The common four-number form of an IP address, such as 198.51.100.77. A DNS query[A] asks for this kind of address.
Isolation: Cutting a compromised machine off from the network so the attacker can't use it, while leaving it powered on. Turning it off would destroy the memory evidence, so you isolate first and capture memory before any shutdown.

J

jq: A command-line tool that reads JSON records and pulls out named fields. -r prints plain text and @tsv makes tab-separated columns.
JSON (JavaScript Object Notation): A structured text format with named fields. SIEMs prefer it because you can search a field like dest_ip without guessing column positions.

K

Kerberos: The main sign-in protocol used in Windows domain networks. A domain controller records its credential checks as events 4768 and 4771.

L

Legal (stakeholder): The company's lawyer, inside or outside the company. Legal issues legal holds, decides on breach notices, directs privileged work, and approves contact with police, regulators and the media.
Legal hold: An order from legal to keep all related data and suspend normal deletion when a lawsuit or investigation is likely. After a customer threatened to sue, Alex suspended Kettle & Crane's log deletion jobs.
LiME: A Linux tool that copies a computer's entire memory to a file.
Log level: A label on each log event that says how serious it is. Python's levels, from least to most serious, are DEBUG, INFO, WARNING, ERROR and CRITICAL.
Log parsing: Turning raw log lines into answers by filtering lines, extracting fields, counting and ordering events. A SIEM's parsers do this automatically, and investigators do it by hand with grep, awk, sort, uniq and jq.
Logwatch: A tool that summarizes Linux logs into a report. Its sshd summary showed the whole password spray in a few lines.
Lookalike domain: A domain made to look like a real company's, such as kettleandcrane-help.example. It belongs to the attacker, who can set it up to pass SPF, DKIM and DMARC.

M

MAC address: The hardware address of a network card. It appears in firewall logs and DHCP lease logs.
Mail reply codes: Codes a mail server records or sends back for each message: 550 means a permanent failure, 5.1.1 means the recipient address doesn't exist, and 2.0.0 means delivered. Postfix used 550 5.1.1 to reject the phishing email sent to the nonexistent payroll@kettleandcrane.com.
Mail server log: A mail server's record of each message received: sender, recipient, and whether it was delivered or rejected. It lets you find every recipient of a phishing email.
Memory dump: A copy of a computer's RAM at one moment, holding running programs, connections, keys and fileless malware; it is lost at power off, so it is taken first. Alex's dump revealed the database password Roast-Ledger-7731.
Message trace: The search tool in a hosted email service that answers 'where did this message go?'
Metadata: Data about data: who, when, where and how big, without the content itself. Examples are email headers, file timestamps, document authors and photo EXIF data.
MFA (multifactor authentication): Signing in with more than one kind of proof, such as a password plus a one-time code or prompt. The identity provider logs each MFA prompt.
MFA fatigue: An attack pattern of many MFA prompts for one account within minutes, followed by one approval.

N

NetFlow: The flow-record format first built into Cisco routers; version 9 uses templates and is described in RFC 3954. On the exam it means the same idea as IPFIX.
Network logs: Records of traffic between computers: who talked to whom, on which port, and whether it was allowed. Sources include firewalls, proxies, DNS and DHCP servers.
Network tap: A small device placed in a network cable that copies all the traffic passing through, for packet capture.
nfcapd: The flow collector from the nfdump tools. It received flow records in the lab.
nfdump: A tool that reads and filters stored flow records. Alex used it to list flows from the shop server to port 8080.
nftables: The Linux firewall. On the shop server it logged and dropped new inbound TCP connections, except on ports 22 and 80, with the label 'KC-FW DROP'.
Nmap: A network scanner. Alex used nmap -sV with the ssh-auth-methods script and found that the shop server's SSH accepted passwords from anywhere.
Nmap Scripting Engine: Nmap's add-on scripts. Its web checks leave a telltale user agent and requests like /nmaplowercheck in a web server's access log.
Non-credentialed scan: A vulnerability scan that does not sign in, so it sees only what an outsider sees, like Alex's Nmap scan of the shop server.
Non-repudiation: Proof that data is unchanged and also came from a particular source, so the source can't deny it. It calls for a digital signature, not just a hash.
Normalization: Putting data from different sources into one common form, such as the same time zone, date format and field names, before sorting or comparing it.
NTLM: An older Windows sign-in protocol. Its credential checks appear on a domain controller as event 4776.
NTP (Network Time Protocol): The protocol devices use to set their clocks accurately. Cameras that don't use it drift, like camera 2, which ran 2 minutes behind.

O

Order of volatility: The rule of collecting the shortest-lived evidence first, from CPU registers and memory down to disk and backups, as listed in RFC 3227. In practice you capture memory before the disk.

P

Packet capture: A full copy of the packets that crossed a link, including headers and payload, saved as a pcap file. It was the only source that showed what was in the upload: Kettle & Crane's customer list.
Page file: A Windows file on disk that holds memory moved out of RAM, so pieces of memory can be recovered from it.
Password spraying: Trying the same one or few common passwords on many accounts, with one or two tries each, so no account reaches the lockout limit. The attacker sprayed alex, jo, morgan and priya, then got into sam.
Payload: The data carried inside packets, as opposed to their headers. Here the payload of the PUT request was the customer file.
Phishing: A deceptive email that tries to trick the recipient, like the 'IT support' message to Sam about an expiring password sent from a lookalike domain.
Pipe: The | symbol, which sends one command's output into the next command, such as grep ... | wc -l.
Port scan: One source trying many ports in a short time to see which are open. In the shop's firewall log, 198.51.100.77 tried ports 21, 3306, 443 and 8080 in one second.
Postfix: A common mail server, the one Kettle & Crane runs. Its log showed the phishing email delivered to Sam.
Process tree: An EDR view that shows each program under the program that started it. It showed sshd starting a shell for Sam that ran four commands, including cp and two curl commands.
PROCTITLE: The audit record that holds the full command that was run, such as cp /srv/shop/exports/customers.csv /tmp/.c.
Proxy: A server that fetches web pages on behalf of users, so its log lists every web address each user visited.
PUT: The web request method that uploads a file. A web server sending a PUT outward, as the shop server did to /u, is a sign of data being pushed out.

Q

QCOW2: The disk file format of the QEMU hypervisor. The shop server's VM disk is shop-vm.qcow2.
QEMU: A hypervisor, the software that runs the shop server as a virtual machine.
qemu-img: A tool that creates (-c) and lists (-l) snapshots of a QEMU disk, and should only touch a disk that is not in use. For a running VM, you take the snapshot through the hypervisor instead, for example with virsh snapshot-create.
Queue ID: A message's number inside a mail server, such as 883FF2C. Every log line about the same message carries it, and it also appears in the Received header.

R

RAM (random access memory): A computer's working memory. It holds running programs, connections and secrets, and is lost when the power goes off.
Regular expression (regex): A pattern that matches text, such as [a-z]+ for one or more lowercase letters. In a regex, a dot means 'any character'.
Retention: How long data is kept before it is deleted or overwritten, such as camera video after 14 to 30 days or shop server logs after 30 days. Export what you need before it is gone, and suspend deletion when a legal hold applies.
RFC (Request for Comments): A numbered document from the IETF that describes an internet standard or guideline, such as RFC 7011 for IPFIX.
RFC 3227: The IETF's guidelines for evidence collection. It sets out the order of volatility.
Rotated logs: Older log lines moved into separate, often compressed, files such as auth.log.1 and auth.log.2.gz, and later deleted on a schedule. Search them too.

S

Server log: A log from the operating system or a service such as the web server. It sees requests and service events, but not their business meaning.
sFlow: A flow format related to NetFlow that sends samples of packets instead of whole-flow summaries.
SHA-256 (Secure Hash Algorithm, 256-bit): A widely used hash algorithm that gives a file a unique fingerprint. Alex used the SHA-256 hash of the attacker's tool to search for it on other machines.
sha256sum: The Linux command that computes SHA-256 hashes. With -c it re-checks files against saved hashes and reports OK or FAILED.
sid (signature ID): The ID number of an IDS rule, such as 9000003. It appears in each alert the rule raises.
SIEM (security information and event management): A system that collects logs and alerts from many tools, parses them, and uses correlation rules to raise alerts that link related events. It also powers dashboards and reports.
Signature: A pattern describing a known bad file or known bad traffic, which antivirus or an IDS matches against. A brand-new attacker tool matches no signature until someone writes one, as Alex did for ClamAV.
Slack space: The unused end of each storage block after a file's last byte, where old data can remain. Only a bit-level copy captures it.
Snapshot: A quick record of a virtual machine's or storage volume's state at one moment, made without stopping the machine. Alex took an 'incident' snapshot before rolling the shop VM back to 'weekly'.
sort: A Linux command that puts lines in order. -rn sorts by number, largest first.
SPAN port (Switched Port Analyzer): A switch port that receives copies of traffic from other ports, used for packet capture.
SPF (Sender Policy Framework): An email check that compares the sending server's address with the list of servers a domain allows to send its mail. Its result is recorded in the Authentication-Results header, alongside DKIM and DMARC.
Spoofing: Faking the sender of an email so it appears to come from someone else, such as your own domain. A DKIM or DMARC fail on a From line that uses your own domain points to spoofing.
SSH (Secure Shell): The encrypted way administrators sign in to a Linux server remotely, using a password or a key. The attacker signed in to the shop server as sam over SSH on port 22.
sshd: The SSH service program on a Linux server. It writes each sign-in attempt to the authentication log.
Stack trace: The list of program steps that led to a crash. It counts as part of an application log.
Stakeholder: A person or group that is affected by an investigation or needed to complete it. Objective 4.8 names three inside the company: HR, accounts and legal.
stat: A Linux command that shows a file's metadata, such as size, owner and its four timestamps, without opening its content.
strings: A Linux command that lists the readable text inside a binary file. Alex used it to find the password in a memory dump and deleted customer records in a disk image.
sudo: The Linux command for running a command as administrator, and every use is logged. 'user NOT in sudoers' meant Sam's account was refused when it tried to read /etc/shadow.
Suricata: A free intrusion detection system. It watched the shop's network and raised three alerts that tracked the attack: the web probe, the SSH spray and the upload.
Surveillance footage: Video from security cameras that shows who was physically present. Export the original quickly before it is overwritten, hash it, log it in the chain of custody, and correct for the camera's clock offset.
swaks: A command-line tool for sending test emails. Its name in the X-Mailer header showed that the phishing email was not a real IT notice.
SYN: The TCP flag on the first packet of a connection. In a firewall log it shows someone trying to connect.
SYSCALL: The audit record that says which system action happened (such as openat), whether it succeeded, which program did it, and the account IDs, including auid.
Sysmon: Microsoft's free tool that adds detailed endpoint events to the Windows event log. Event ID 1 is a process created and event ID 3 is a network connection.
System image: A copy of a system's state, kept so it can be examined later without touching the original. The three kinds are a memory dump, a bit-level copy and a snapshot.

T

TCP (Transmission Control Protocol): The protocol that carries connections such as SSH and web traffic. Its flags, like SYN, show up in firewall logs and flow records.
tcpdump: A command-line packet capture tool. Alex's capture used -i eth0 for the interface, -s 0 for whole packets and -w to save to a pcap file.
Telemetry: The activity records an EDR agent collects: programs started, their parents, command lines, files and network connections.
Timeline: All the events of an incident from every source, converted to one time zone and sorted into a single ordered list. Alex's timeline put the shop breach on one page for the insurer and legal.
TLS (Transport Layer Security): The encryption that protects HTTPS. A request stays unreadable until it reaches the server, or a load balancer or WAF that ends TLS, so only logs there can show the content.
Tripwire: A file integrity monitoring tool that alerts when important files change.
tshark: The command-line version of Wireshark. -Y applies a display filter, -e picks fields, and -z follow,tcp rebuilds a TCP connection as text.
TZ: A Linux environment variable that tells a command which time zone to show times in. Alex used it with date to convert UTC log times to Portland time.

U

Unallocated space: The free areas of a disk, where data from deleted files can remain until it is overwritten.
uniq -c: A Linux command that counts identical lines next to each other, so you sort first.
User agent: The field in a web request that names the sending program, such as curl/8.5.0 or 'Nmap Scripting Engine'. Attackers can change it, so its absence proves nothing.
UTC (Coordinated Universal Time): The world's reference clock, written as Z or +0000. The shop server logs in UTC, which is 8 hours ahead of Portland in November.

V

Video recorder: The device that stores building camera footage. It overwrites old video, often after 14 to 30 days, so export the clips you need right away using its own export.
Virtual machine (VM): A computer simulated in software on a host computer, like the shop server.
VoIP (Voice over Internet Protocol): Phone calls carried over the internet. The VoIP server keeps the call records.
Volatility framework: A free tool that analyzes full memory dumps and lists processes, connections and loaded code.
VPN (virtual private network): An encrypted connection into a company network. VPN servers record who connected.
Vulnerability scan: A check of systems for known weaknesses such as open ports, flawed software versions and unsafe settings. It shows a system's state, not events, and it revealed that SSH password sign-in was the attacker's way in.

W

WAF (web application firewall): A firewall for a website that blocks attacks on it. It can also be the device that ends TLS, so it sees the decrypted requests.
wc -l: A Linux command that counts lines, for example the number of 'Failed password' lines.
Web access log: The web server's record of each request: the visitor's address, time, page asked for, status code and user agent. It saw the gift card guesses only as normal page loads, but it did show the attacker's Nmap user agent.
Windows Security event IDs: Numbers for Windows Security log events: 4624 successful sign-in, 4625 failed sign-in, 4740 account lockout, 4768 and 4771 Kerberos credential checks, 4776 NTLM credential check, and 1102 audit log cleared (a sign an attacker may be hiding). Sign-in events are written on the computer signed in to; credential checks and lockouts are recorded on the domain controller.
WinPmem: A Windows tool that copies a computer's whole memory to a file.
Wireshark: A packet capture and analysis tool with a graphical screen.
WORM (write once, read many): Storage where logs can't be changed or deleted for a set time, so they stay trustworthy evidence.
Write blocker: A device or setting that lets a computer read a drive but never write to it, used when making a bit-level copy.

X

X-Mailer: An email header that names the program that sent the message. In the phishing email it was swaks.

Z

zgrep: A version of grep that searches compressed files, such as rotated logs like auth.log.2.gz.