Which term describes the process of analyzing log data to determine when a security incident began, who initiated it, the sequence of actions, and the resulting business impact?

Which term describes the process of analyzing log data to determine when a security incident began, who initiated it, the sequence of actions, and the resulting business impact?

• A. Log Forensics
• B. Cyber Forensics
• C. Incident Response
• D. Threat Hunting

Answer: (A)

Analyzing log data to reconstruct when an incident began, who initiated it, the sequence of actions, and the resulting business impact is log forensics. Logs provide time-stamped evidence of events across systems, users, and applications, so examining them lets investigators establish the exact start point, identify the actor or process involved, trace the steps taken, and quantify the impact on the business. This is a focused forensic activity centered on logs. Cyber forensics covers digital evidence more broadly, incident response is about reacting to and containing incidents, and threat hunting is about proactively seeking undiscovered threats; none of these as precisely pin down the detailed timeline and impact from logs like log forensics does.

Analyzing log data to reconstruct when an incident began, who initiated it, the sequence of actions, and the resulting business impact is log forensics. Logs provide time-stamped evidence of events across systems, users, and applications, so examining them lets investigators establish the exact start point, identify the actor or process involved, trace the steps taken, and quantify the impact on the business. This is a focused forensic activity centered on logs. Cyber forensics covers digital evidence more broadly, incident response is about reacting to and containing incidents, and threat hunting is about proactively seeking undiscovered threats; none of these as precisely pin down the detailed timeline and impact from logs like log forensics does.