Log Correlation: Tools and Techniques

Abstract

Log file correlation comprises two components: Intrusion Detection and Network Forensics. The skillful and mutualistic combination of these distinct disciplines is one of the best guarantees against Points of Failure. This chapter is organized as a tutorial for practitioners, providing an overview of log analysis and correlation, with special emphasis on the tools and techniques for handling them in a forensically compliant manner.