Practice: The Expired Certificate

The situation

It's a Tuesday morning. The help desk has several tickets saying the same thing: the timesheets app at timesheets.corp.example shows a security warning and won't load. Mail and other sites work. You have the network sensor's TLS records for the morning. Your job: find out what happened, when, and what fixed it, and write it up for the next analyst.

TLS is the layer that encrypts web traffic. Before any page loads, the server presents a certificate, and the client checks that it is valid. These records describe that check.

The data

Eight invented TLS records from the network sensor. Times are UTC. To keep them readable, workstations are shown by name; a network sensor usually records addresses, which you would match to names from other logs.

• tls.established: true if the encrypted session was set up, false if the client refused it.
• tls.server.x509.not_after: the moment the server's certificate stops being valid.

Practice searches

1. S1.
   Which query returns every record for the timesheets server?

   • A.destination.domain: "timesheets"
   • B.destination.domain: "timesheets.corp.example"
   • C.destination.domain: "mail.corp.example"

2. S2.
   Which query returns only the failed sessions to the timesheets server?

   • A.destination.domain: "timesheets.corp.example" and not tls.established: false
   • B.destination.domain: "timesheets.corp.example" or tls.established: false
   • C.destination.domain: "timesheets.corp.example" and tls.established: false

3. S3.
   Which query returns the failures from workstations other than ws-204?

   • A.tls.established: false and not source.domain: "ws-204.corp.example"
   • B.tls.established: false and source.domain: "ws-204.corp.example"
   • C.not source.domain: "ws-204.corp.example"

4. S4.
   Which query returns every workstation's records?

   • A.source.domain: "ws-*.corp.example"
   • B.source.domain: ws-*.corp.example
   • C.source.domain: "ws-204.corp.example"

5. S5.
   E3 failed. Which field best explains why?

   • A.source.domain
   • B.destination.port
   • C.@timestamp on its own
   • D.tls.server.x509.not_after

6. S6.
   You search user.name: * in this data and get no records. What does that tell you?

   • A.Nobody was signed in that morning
   • B.These TLS records don't carry an account field
   • C.The query syntax is wrong
   • D.The records were deleted

Investigate

Now put it together. Work through each step before you open its hints. The hints get more specific; use as few as you need.

1. Step 1When did it start, and when did it end?

   Show a hintShow the answer

2. Step 2Was it one workstation or many, and was it one server or all of them?

   Show a hintShow the answer

3. Step 3What caused it?

   Show a hintShow the answer

4. Step 4What fixed it?

   Show a hintShow the answer

5. Step 5What would you tell the next analyst?

   Write your answer under the notebook's headings, then compare it with ours.

   Show our write-up

This was an outage with a clear cause, not an intrusion. Most investigations end like this one: a timeline, a cause backed by evidence, and a note someone else can check. First Light is next, and it uses the same steps on a live range.

• Next: First LightYour first case on the Analyst Foundations path.