Incident Response

Responding to network security problems can be a very consuming process. Realizing that there is, or rather was, an incident to respond to can be an extremely challenging effort. For many network administrators, getting that piece of e-mail that suggests that a machine at their site was involved in a breakin six months ago, can be the nightmare of the week.

The comprehensive audit of network activity that Argus can generate has been used by many sites to validate and investigate historical security incidents. And the comprehensive audit allows an investigator to realize the extent of an incident, and in many cases the who, what, when, and where of the actual initial event.

Argus data currently supports the ability to perform a large number of network forensic tasks in support of incident response. Future releases of Argus should have tools that make the work of network forensics and incident response much easier.