Contents

• Executive Summary
• Analysis
  • Log Data
  • MAC Addresses
  • Subnets
  • Topology
  • Communications
  • Top Talkers
  • Gateway's Role
  • Services
  • Missing Snort Alerts
  
  
• Investigations
  • Snort Alert Investigations
  • Scripted and Automated Activity
    • The Automated Behavior
    • First Event
    • Second and Third Event
    • Fourth Event
    • Fifth Event
    • Sixth Event
  • Attack Chains
  • Proxy Servers
  
  
• TCPDump Output
• Graphing Event Data
• Severity Analysis
• Bibliography