i2 Analyst's Notebook
July 11, 2006
$3,652, inc. one year's support
- Ease of Use:
- Value for Money:
- Overall Rating:
- Strengths: Superb link analyser with a stellar pedigree.
- Weaknesses: Not targeted directly at IT security incidents in its training, icon sets or application notes.
- Verdict: Intuitive, powerful analysis tool for complex incidents.
This is a very different type of analysis tool from those infosec professionals are used to. Link analysis, a crucial aspect of incident response, is usually done manually or by trying to use log correlators. This is a true link analyser with a long pedigree in analysing complex crimes and security incidents.
The application does all the installation work, after which come example charts and a superb help system to quickly move you from installation to production.
Within the first two hours, we had imported and analysed metadata from EnCase for a detailed analysis of data on a hard disk, put in hacker profiles to analyse inter-relationships between hackers and hacks, and analysed a 65,000 record IDS log for links between attacks and attackers.
Link analysis is applied to incident response post mortem. Logs, events and other data feed the link analyser’s analysis process. The easiest way to input data is by importing from a spreadsheet using a CSV file. This allows users to import logs of virtually any kind into the analyser, then the tool sets up the relationships and displays them in various formats.
Once data is organised, viewing relationships is intuitive. Analyst’s Notebook is part of a suite of products that allow very large, complex logs to be analysed and subtle connections to be found in extensive distributed enterprises.
Most documentation is in the help file, which we found helpful, while directories are created with extensive PDF files and examples, as well as a paper Quick Start Guide and a Guide to Power2, the core technology in the product.
Support is also extensive, with online and phone support and consulting teams available to assist with difficult cases.
The product is priced in the range of most forensic tools and far lower than typical log analysis appliances. The product will also reduce significantly the analysis time for an incident, so it can be resolved, production restored and large amounts of data analysed.
Rather than replacing log correlators, Analyst’s Notebook leverages existing investment in expensive tools. The cost of the product and user training will be amortised in the first incident upon which it is used.
Sign up to our newsletters
SC Magazine Articles
- Long list of devices believed to be affected by NetUSB vulnerability
- CareFirst BlueCross BlueShield breached, more than one million individuals notified
- Study: 86 percent of websites contain at least one 'serious' vulnerability
- Study: Employees acknowledge risky security behavior, continue to engage in it
- Report: $19M breach settlement between MasterCard, Target terminated
- Hackers exploit Starbucks auto-reload feature to steal from customers
- Study: Nearly all SAP systems remain unpatched and vulnerable to attacks
- Former Nuclear Regulatory Commission employee arrested for alleged spear phishing campaign
- Millions of WordPress websites vulnerable to XSS bug
- FireEye first cybersecurity firm awarded DHS SAFETY Act certification
- Senate fails to pass USA Freedom Act; McConnell moves for revote of Patriot Act extension
- Android ransomware distributed to English speakers in spam campaign
- Site operator sentenced to 13 months for facilitating prostitution
- ISA presses for data to shape cyber security policy, encourages use of NIST framework
- Former Jacobi Medical Center employee improperly emails patient data