i2 Analyst's Notebook
July 11, 2006
$3,652, inc. one year's support
- Ease of Use:
- Value for Money:
- Overall Rating:
- Strengths: Superb link analyser with a stellar pedigree.
- Weaknesses: Not targeted directly at IT security incidents in its training, icon sets or application notes.
- Verdict: Intuitive, powerful analysis tool for complex incidents.
This is a very different type of analysis tool from those infosec professionals are used to. Link analysis, a crucial aspect of incident response, is usually done manually or by trying to use log correlators. This is a true link analyser with a long pedigree in analysing complex crimes and security incidents.
The application does all the installation work, after which come example charts and a superb help system to quickly move you from installation to production.
Within the first two hours, we had imported and analysed metadata from EnCase for a detailed analysis of data on a hard disk, put in hacker profiles to analyse inter-relationships between hackers and hacks, and analysed a 65,000 record IDS log for links between attacks and attackers.
Link analysis is applied to incident response post mortem. Logs, events and other data feed the link analyser’s analysis process. The easiest way to input data is by importing from a spreadsheet using a CSV file. This allows users to import logs of virtually any kind into the analyser, then the tool sets up the relationships and displays them in various formats.
Once data is organised, viewing relationships is intuitive. Analyst’s Notebook is part of a suite of products that allow very large, complex logs to be analysed and subtle connections to be found in extensive distributed enterprises.
Most documentation is in the help file, which we found helpful, while directories are created with extensive PDF files and examples, as well as a paper Quick Start Guide and a Guide to Power2, the core technology in the product.
Support is also extensive, with online and phone support and consulting teams available to assist with difficult cases.
The product is priced in the range of most forensic tools and far lower than typical log analysis appliances. The product will also reduce significantly the analysis time for an incident, so it can be resolved, production restored and large amounts of data analysed.
Rather than replacing log correlators, Analyst’s Notebook leverages existing investment in expensive tools. The cost of the product and user training will be amortised in the first incident upon which it is used.
SC Magazine Articles
- Yahoo breach; State-sponsored actors suspected, at least 500 million accounts affected
- Cybercriminals already able to hack ATM biometric readers
- Education sector bullied by ransomware and can barely defend itself, report
- IoT assault, connected devices increasingly used for DDoS attacks
- Cisco warns of exploitation of new flaws linked to Shadow Brokers exploits
- Microsoft Office 365 hit with massive Cerber ransomware attack, report
- Hard Rock Hotel & Casino Las Vegas hit with POS breach
- X-ray and MRI machines among devices used as springboards for data breach attacks
- Hacker purportedly selling over 650,000 stolen medical records on dark web marketplace
- Wi-Fi warning! Study finds U.S. unaware of public Wi-fi risks
- Presidential debate 2016: Candidates pledge cyber investment, differ on Russia
- Yahoo faces congressional action and class action lawsuits following historic data breach
- Case study: Hawaiian Telcom says aloha to AlienVault security management
- Pippa Middleton's iCloud account hacked
- OpenSSL patches 14 vulns, including high-severity flaw that can be exploited for DoS attacks