I have FTP logs and some other logs assuming that corporate environment is actively monitored. How would I know that user is using ftp to transfer regular file and not using the same to transfer confidential file from an organization. or in other words how would I (as a soc analyst) identify that the ftp server is the server not being used by the company for their data storage but the employee is using that particular ftp server for data storage. And transferring data to that server will be considered as Data Exfiltration. Please assume you have access to all the logs and you can use those logs for analysis. I would appreciate if somebody could explain me which logs to consider and what fields are critical in those logs and how?
What you're looking for is the intent of the user at the time they're performing the operation, and that's very hard to determine from logs alone. Some factors to consider:
- What is the volume of data being transferred?
- Does the remote endpoint belong to your company, or a partner company?
- Has this user conducted transfers of this type in the past, or is the behavior unusual for the user?
- Do the files being transferred make sense as a single logical data set?
- Have other users connected to that host before?
This is why good analysts are so critical: they can combine the information in the logs with other information available to them. Information outside the logs that might be useful in this case:
- The user's role in the company, and how it relates both to the data being accessed as well as the transfer itself.
- The time of day at the user's location.
- Any open bugs/tickets/work orders requesting the data transfer.
- The duration of employment of the user.
At the end of the day, you need a lot more information to determine the reason for a particular action. Logs alone are not enough.