Cybersecurity forensics is the careful preservation and examination of evidence after a security incident. It helps establish what happened, which systems or data were affected, and whether the findings can support legal or regulatory action. Unlike rapid incident triage, forensic work first protects the affected environment from changes that could contaminate evidence. section 9.8 section 9.12
A practical investigation moves from reliable records to a defensible account of the incident:
- Secure affected systems and preserve evidence. Keep logs in tamper-evident storage, and maintain a chain of custody for collected evidence. section 9.8 section 7.4.3 section 9.4.4
- Correlate logs and other indicators, then reconstruct a timeline from initial detection through subsequent activity and response. Use it to investigate the root cause and assess affected systems, data, and business operations. section 9.5
- Examine beyond ordinary logs when needed: disk imaging can retain deleted data and unallocated space; memory analysis can reveal volatile processes; network forensics can investigate exfiltration or lateral movement. section 9.8
Failed logins on a database server
A surge of failed admin logins triggers a Wazuh SIEM alert. Investigators collect SIEM, firewall, and database access logs, block the source IP, and reset the password. Forensic analysis remains open while they determine whether any login succeeded before the block. The incident record names who created and reviewed it and who collected the evidence; subsequent review calls for faster brute-force detection. section 9.4.4
Report findings in terms decision-makers can use: what the evidence establishes, what remains uncertain, the operational or data impact, and which response improvements deserve priority. A suspicious alert alone does not establish a breach. section 9.5 section 9.4.4
