Discover what you cannot answer, and fix the collection

applied · 80 min · Objective 4.9

Task

Pose five investigative questions, try to answer each from the logs you actually collect, and record which ones you cannot. A hunt that ends at 'we do not collect that' has produced the most actionable finding available.

Steps

  1. Write five questions into /tmp/questions.md that a real investigation asks: which process made this connection; who was logged in at this time; what did this account access yesterday; was this file executed anywhere else; and did anything else contact this address.
  2. For each, attempt the answer from the logs you currently have. Record the answer, or record precisely what is missing.
  3. For every question you could not answer, identify the specific collection change that would fix it — a log that is not enabled, a field that is not recorded, a retention period that is too short, a host that is not forwarding.
  4. Implement two of those changes.
  5. Re-generate the activity and confirm those two questions are now answerable.
  6. Write /tmp/coverage.md listing all five questions, whether each is answerable now, and what the remaining gaps would cost during a real incident.

Verify

python3 - <<'PY'
import re
t=open('/tmp/coverage.md').read()
qs=re.findall(r'^\s*[-*\d.]+\s*(.+?)\s*[-–—:]\s*(ANSWERABLE|NOT ANSWERABLE)',
              t, re.M|re.I)
assert len(qs)>=5, 'fewer than five questions assessed, found %d' % len(qs)
ok=[q for q,s in qs if s.upper().startswith('ANSWER')]
print('%d of %d questions answerable' % (len(ok),len(qs)))
assert len(ok)>=2, 'the two collection changes did not make two questions answerable'
assert len(ok)<len(qs), 'everything is answerable - the questions were too easy'
PY
grep -ciE "retention|not enabled|not forwarding|field" /tmp/coverage.md

Both bounds matter. At least two questions must have become answerable, proving the collection changes worked; and at least one must remain unanswerable, because a set of questions your current logging already covers was not testing the collection at all.

Notes

This is threat hunting's most under-rated output. A hunt that finds no attacker but establishes that you cannot answer 'what process made this connection' has found something worth more than most alerts — and it is a gap you can close before you need the answer at 3am.

This is an independent study companion for CompTIA Security+ SY0-701 and is not produced by or endorsed by CompTIA.