Security+ 801 Countdown, T-8: From Telemetry to Evidence With syslog, Memory Dumps, and Log Parsing

Security monitoring produces telemetry: syslog messages from servers, SNMP values polled from switches, flow records exported by routers, and copies of packets from a mirror port or a tap. An investigation turns some of that telemetry into evidence, which carries a higher burden than a dashboard tile: it must be acquired in the right order before it disappears, hashed so that it can be shown unchanged, and parsed so that timestamps from different sources agree. SY0-801 treats collection and investigation as one pipeline: objective 4.4, “Explain security alerting and monitoring concepts and tools,” adds a Protocols group (NetFlow, SNMP, syslog, SCAP) along with port mirroring, automated alerts, and network management systems, and scenario objective 4.8, “use data, artifacts and sources to support a security investigation,” adds memory dumps, bit-level copies, snapshots, file/log integrity, stakeholders, and log-parsing techniques (CompTIA 2025).

This post follows that pipeline in order: the protocols that carry telemetry, where a sensor must sit to see traffic, how memory and disk are captured from a suspect host, and the hashing and parsing that make the result defensible.

The protocols that carry telemetry

The four protocols answer different questions. syslog delivers event messages, SNMP exposes device state, NetFlow and IPFIX summarize conversations, and SCAP is a set of specifications rather than a wire protocol. The table gives ports and security posture; the subsections give mechanisms.

Protocol	Carries	Transport	Security
syslog	Event messages	UDP 514; TLS on TCP 6514; DTLS on UDP 6514	TLS is mandatory to implement
SNMP	Polled MIB values, traps, informs	UDP 161 to agents; UDP 162 to managers	v1/v2c plaintext; v3 authPriv encrypts
NetFlow v9, IPFIX	Endpoints, ports, bytes, packets, times	IPFIX 4739, or 4740 secured; NetFlow has no IANA port	Typically no payload
SCAP	Checklists, identifiers, scores	Not a wire protocol	TMSAD signs content

syslog

syslog is a message format and a transport, not a SIEM. A SIEM is the system that collects those messages, normalizes them, correlates them across sources, and raises alerts; syslog is one of its feeds. RFC 5424, which obsoletes the BSD format of RFC 3164, defines a header of PRI, VERSION, TIMESTAMP, HOSTNAME, APP-NAME, PROCID, and MSGID, followed by STRUCTURED-DATA and the free-text MSG (Gerhards 2009). An illustrative line:

<38>1 2026-11-09T10:14:07.412Z web01.example.com sshd 48211 - [timeQuality tzKnown="1" isSynced="1"][meta sequenceId="4182"] Connection closed by 203.0.113.45 port 52114 [preauth]

The PRI field in angle brackets encodes two values in one number: PRI = facility × 8 + severity, where facility identifies the kind of source and severity ranks urgency. So <38> is facility 4 (security/authorization) and severity 6 (Informational), OpenSSH’s default (OpenBSD n.d.). Decode with integer division and remainder: RFC 5424’s own <34> is facility 4, severity 2, Critical. Severity runs backward: 0 is Emergency and 7 is Debug, so a lower number is a worse event. The structured-data block carries machine-readable context; here timeQuality says the clock was synchronized and its zone known, and meta sequenceId numbers the message. A gap in that sequence means UDP loss or deletion (my inference; RFC 5848 signed syslog detects missing messages by design).

Transport is where candidates lose points. UDP 514 is the RFC 5426 transport, but RFC 5424 makes TLS on TCP 6514 the transport that implementations must support (Miao, Ma, and Salowey 2009). IANA assigns TCP 514 to rsh, not syslog, and plain TCP syslog (RFC 6587) is Historic (IANA 2026). One more trap comes from the older format: a BSD stamp such as Nov 9 05:14:07 has no year and no time zone, which matters when logs from several sources are merged.

SNMP

SNMP is a manager-and-agent protocol with three message patterns. A manager polls agents with GetRequest, GetNextRequest, or GetBulkRequest on UDP 161, and agents push either unconfirmed traps or confirmed informs to the manager on UDP 162 (RFC 3416; RFC 3417). The values exchanged are entries in a management information base (MIB), the tree of named objects a device exposes, and a network management system is the manager side of that exchange (an interpretation, since CompTIA does not define the term).

Security depends entirely on the version. RFC 3410 calls the community strings of v1 and v2c “plain-text” and “fundamentally insecure” (Case et al. 2002), so snmpwalk -v2c -c public 192.0.2.1 exposes its secret, public, to anyone capturing the segment. SNMPv3 is not automatically encrypted either: noAuthNoPriv is valid v3 with neither authentication nor privacy, authNoPriv adds message integrity, and only authPriv adds privacy, through the User-based Security Model (Blumenthal and Wijnen 2002) or RFC 6353’s TLS/DTLS model.

NetFlow and IPFIX

NetFlow and IPFIX export flow records rather than packets. RFC 3954 defines a NetFlow v9 flow as “a unidirectional sequence of packets with some common properties” (Claise 2004), such as the endpoints, ports, and protocol below. IPFIX (RFC 7011, STD 77) is the IETF standard built from it, with header version 10 (Claise, Trammell, and Aitken 2013). A record in IPFIX element names:

flowStartMilliseconds     2026-11-09T07:02:11.000Z
flowEndMilliseconds       2026-11-09T07:47:40.000Z
sourceIPv4Address         192.0.2.44
destinationIPv4Address    203.0.113.45
destinationTransportPort  443
protocolIdentifier        6
octetDeltaCount           2147483648

Read it as a sentence: one TCP flow (protocol 6) from 192.0.2.44 moved 2 GiB to port 443 on an external host in about 45 minutes. That proves volume, timing, and endpoints, which is what exfiltration and beaconing (many small, regular flows) questions turn on, but not content. Flows typically carry no payload, although IPFIX defines payload elements such as IE 314, so when the question is what was sent, the answer needs packet captures and a packet analyzer.

SCAP

SCAP, the Security Content Automation Protocol, sits under Protocols in the objective but is a suite of specifications rather than something that moves across a wire. NIST SP 800-126 Rev. 4 (June 2026) defines SCAP 1.4 as 12 components, including XCCDF, NIST’s language for authoring checklists and benchmarks, plus OVAL, CPE, CVE, and CVSS v4.0 (Prisaca et al. 2026). Scanning with that content is covered at T-13 and orchestration at T-10.

Automated alerts and dashboards sit on top of all four protocols: they summarize what a SIEM has already parsed, filtered, and correlated, but the evidence in an investigation remains the underlying logs, flows, and captures (my interpretation).

Where the sensor sits: inline, SPAN, or tap

A protocol only reports what its sensor can see, and on a switched network that depends on placement. NIST SP 800-94 Sec. 4.2.2 frames the choice (Scarfone and Mell 2007). An inline sensor sits in the traffic path, so every frame passes through it and it can block. A passive sensor watches a copy delivered from a spanning port, a tap, or an IDS load balancer, so prevention generally requires inline placement; the most a passive sensor can do is send TCP resets (“session sniping”), often too late.

Placement	Sees	Blocks	Caveat
Inline (IPS)	All traffic, in the path	Yes	Failure modes at T-20
SPAN/port mirror	A copy from the switch	No	Drops under load or oversubscription
Network tap	Full copy of one link	No	Install needs downtime

Port mirroring, which Cisco calls SPAN, copies frames from source ports to a destination port where the sensor listens. A local SPAN session on Cisco IOS XE:

Device(config)# monitor session 1 source interface gigabitethernet1/0/1 both
Device(config)# monitor session 1 destination interface gigabitethernet1/0/24

The destination port forwards no normal traffic and cannot also be a source, and Cisco warns that an oversubscribed destination, “a 10-Mb/s port monitoring a 100-Mb/s port,” drops packets (Cisco 2022). That drop is the practical difference between a mirror and a tap: a tap copies all traffic on one link without forwarding it, at the cost of downtime to install. Inline failure modes are covered at T-20. Cue: misses traffic at peak load means SPAN; must block means inline; every frame without entering the path means tap.

Acquiring the system: memory before disk

Once a host is suspect, what to capture first is set by volatility. RFC 3227 orders evidence from most to least volatile: registers and cache; routing table, ARP cache, process table, kernel statistics, and memory; temporary file systems; disk; remote logs; physical configuration and topology; archival media. It says not to shut down until collection is complete (Brezinski and Killalea 2002). NIST SP 800-86 lists network connections and login sessions before memory contents (Kent et al. 2006), so the safe claim is memory before disk, not memory always first.

The three artifacts under System image answer different questions. A memory dump is a copy of physical RAM at one moment. A bit-level copy reproduces every sector of a storage device, including slack and unallocated space, rather than copying files. A snapshot is a point-in-time record of a VM or volume taken by the hypervisor or cloud platform, neither a RAM capture nor a sector image.

Artifact	Captures	Misses	Scenario cue
Memory dump	Processes, sockets, injected code, keys in use	Anything not in RAM	Fileless malware, live C2
Bit-level copy	Every sector, including slack and unallocated	Volatile state	Deleted files, discipline, prosecution
Snapshot	Point-in-time VM or volume state	Cache, for cloud volumes; not a sector image	Cloud VM you cannot unplug

Memory

C:\> winpmem_mini_x64.exe physmem.raw
$ vol -f physmem.raw windows.pstree
$ vol -f physmem.raw windows.netscan
$ vol -f physmem.raw windows.malware.malfind

WinPmem’s mini build writes a raw image of physical memory (Velocidex n.d.). On Linux, LiME can stream the capture over TCP (path=tcp:4444) to a collector’s nc instead of writing it to /tmp on the disk you are about to image (504ensicsLabs n.d.); preferring the stream follows from RFC 3227’s “Minimise changes to the data” (an inference, not a step the RFC spells out). In Volatility 3 v2.28.2, windows.netscan ties sockets to PIDs, and windows.malware.malfind, which replaces the deprecated windows.malfind, flags private memory that is both writable and executable, the mark of injected code (Volatility Foundation 2026). Parent-child process chains are at T-30.

Disk

With the source disk behind a hardware write-blocker, a device that passes reads and refuses writes so the original cannot be altered:

$ dc3dd if=/dev/sdb hof=/mnt/evidence/case117-sdb.dd hash=sha256 log=/mnt/evidence/case117-sdb.log

hof= hashes the image and compares it with the input hash (Kali n.d.); SP 800-86 adds re-hashing the original afterward, so the image can be shown to match the source and the source shown unchanged. Cloud hosts change the mechanics: an Amazon EBS snapshot “does not include data that has been cached by applications or the operating system” (AWS n.d.a), so it suits a VM you cannot unplug but does not replace a memory dump or a sector image. Snapshots as backups are at T-17.

Proving integrity and parsing the result

A responder who has collected logs and images now has to prove two things: that the artifacts are what was collected, and that the events they describe line up. The first is file and log integrity. It differs from file integrity monitoring (FIM), a control that watches system files for change; integrity here is something you prove about evidence. SP 800-92 defines log file integrity checking as “calculating a message digest for each file and storing the message digest securely” (Kent and Souppaya 2006). Stronger forms build the protection into the log or the storage itself: journald Forward Secure Sealing (journalctl --setup-keys, then --verify), RFC 5848 signed syslog, and WORM storage such as S3 Object Lock compliance mode, where even root cannot delete a protected version (AWS n.d.b).

$ sha256sum access.log.1 > access.log.1.sha256
$ sha256sum -c access.log.1.sha256
access.log.1: OK

$ cat access.log
203.0.113.45 - - [09/Nov/2026:00:14:07 -0500] "GET /.git/config HTTP/1.1" 404 153 "-" "python-requests/2.32.3"
203.0.113.45 - - [09/Nov/2026:00:14:08 -0500] "GET /.env HTTP/1.1" 404 153 "-" "python-requests/2.32.3"
$ awk '$9==404 {print $1}' access.log | sort | uniq -c | sort -nr
   2 203.0.113.45
$ date -u -d '09 Nov 2026 00:14:07 -0500' +%FT%TZ
2026-11-09T05:14:07Z

The first two commands are the digest in practice: compute a SHA-256 for the rotated log, store it, and verify it later. The rest is log parsing, and SP 800-92 supplies the vocabulary candidates blur. Parsing extracts fields; filtering suppresses entries; aggregation consolidates similar entries with a count; normalization converts fields, commonly timestamps, to one representation; and correlation relates entries, often across sources (Kent and Souppaya 2006). The awk line does three at once: split on spaces, nginx’s combined format puts the status in $9 (nginx n.d.), so $9==404 filters, {print $1} parses out the client address, and uniq -c aggregates. The date line is normalization: -0500 is Eastern Standard Time, since US daylight saving time ended November 1, 2026, and the command rewrites the stamp in UTC. Normalize to UTC before merging sources; RFC 3227 says to record whether each timestamp is UTC or local, and the zoneless BSD stamp from earlier is exactly the case that goes wrong.

Sources and stakeholders

SY0-801 lists its log and trace data types without defining them, so this mapping is an interpretation rather than CompTIA’s: firewall logs fit Device, OS-specific security logs fit Server or Audit, and IPS/IDS logs fall under the Security tools data source. Logical access and accounting includes RADIUS Start and Stop accounting records on UDP 1813 (Rigney 2000); physical includes badge logs, which pair with Surveillance footage.

The investigation also has people in it. SP 800-86 Sec. 2.3 says HR assists with “employee relations and the handling of internal incidents,” and legal advisors ensure “forensic actions are performed lawfully.” CompTIA does not define Accounts; the likely reading is finance or accounting, since auditors “can help determine the economic impact of an incident,” though account owners are possible.

What you need to know for SY0-801

• syslog is a format and transport; a SIEM collects, normalizes, correlates, and alerts.
• PRI is facility × 8 + severity; severity 0 is the most severe.
• syslog uses UDP 514 or TLS on TCP 6514; TCP 514 is rsh.
• SNMP polls go to UDP 161; traps (unconfirmed) and informs (confirmed) go to UDP 162. Only v3 authPriv encrypts.
• Flows answer who, when, and how much; packet captures answer what was sent.
• Must block means inline; every frame without entering the path means tap; peak-load drops mean SPAN oversubscription.
• Memory before disk; do not pull the plug. In-memory evidence needs a memory dump; deleted files or slack space need a bit-level copy.
• Hash at acquisition and re-hash to verify; FIM was a control, file/log integrity is proof.
• Normalization converts timestamps to one representation, usually UTC; correlation relates entries across sources.

Check yourself

These are original practice questions, not exam items.

1. An IDS fed by a switch’s only SPAN port drops packets whenever the monitored 10 Gb/s uplink is busiest. It must see every frame without entering the forwarding path. What should the engineer do?

• A. Add a second SPAN session to the same destination port.
• B. Install a network tap on the uplink and feed the IDS from it.
• C. Move the IDS inline as an IPS.
• D. Enable NetFlow export on the uplink.

Answer: B. An oversubscribed SPAN destination drops packets, while a tap copies all traffic on the link without forwarding it. Inline placement enters the path, and NetFlow has no content.

2. A running Linux server shows an established connection to 203.0.113.45, but no suspicious file exists on disk. What should the responder capture first?

• A. A bit-level copy of the disk after a hard power-off.
• B. A memory dump streamed to a collector.
• C. A cloud volume snapshot.
• D. SHA-256 hashes of every system binary.

Answer: B. The connection and any injected code live in RAM, which is more volatile than disk. Powering off destroys them, and a volume snapshot omits memory.

3. An analyst merges firewall syslog stamped Nov 9 00:14:07 with cloud audit logs in UTC, and events appear out of order. Which log-parsing technique fixes this?

• A. Aggregation.
• B. Filtering.
• C. Normalization.
• D. Correlation.

Answer: C. Normalization converts timestamps to one representation, here UTC. Correlation links entries across sources and misleads until the times agree.

This is T-8 of the Security+ 801 Countdown: one change from SY0-701 to SY0-801 every morning until the new exam launches on November 17, 2026. Tomorrow, T-7: Objective 5.1 Becomes a GRC Artifact Catalog. New here? Start with T-38: The Blueprint Was Reweighted and Trimmed to 27 Objectives.

References

504ensicsLabs. n.d. “LiME: Linux Memory Extractor.” README, GitHub. Accessed October 12, 2026.

Amazon Web Services. n.d.a. “Create Amazon EBS Snapshots.” Amazon EBS User Guide. Accessed October 12, 2026.

Amazon Web Services. n.d.b. “Locking Objects with Object Lock.” Amazon S3 User Guide. Accessed October 12, 2026.

Blumenthal, Uri, and Bert Wijnen. 2002. User-based Security Model (USM) for Version 3 of the Simple Network Management Protocol (SNMPv3). RFC 3414, STD 62. Internet Engineering Task Force.

Brezinski, Dominique, and Tom Killalea. 2002. Guidelines for Evidence Collection and Archiving. RFC 3227, BCP 55. Internet Engineering Task Force.

Case, Jeffrey, Russ Mundy, David Partain, and Bob Stewart. 2002. Introduction and Applicability Statements for Internet-Standard Management Framework. RFC 3410. Internet Engineering Task Force.

Cisco. 2022. “Configuring SPAN and RSPAN.” Network Management Configuration Guide, Cisco IOS XE Cupertino 17.9.x (Catalyst 9300 Switches).

Claise, Benoit. 2004. Cisco Systems NetFlow Services Export Version 9. RFC 3954. Internet Engineering Task Force.

Claise, Benoit, Brian Trammell, and Paul Aitken. 2013. Specification of the IP Flow Information Export (IPFIX) Protocol for the Exchange of Flow Information. RFC 7011, STD 77. Internet Engineering Task Force.

CompTIA. 2023. CompTIA Security+ SY0-701 Certification Exam Objectives. Version 5.0.

CompTIA. 2025. CompTIA Security+ SY0-801 V8 Certification Exam Objectives. Document Version 2.0.

Gerhards, Rainer. 2009. The Syslog Protocol. RFC 5424. Internet Engineering Task Force.

IANA. 2026. “Service Name and Transport Protocol Port Number Registry.” Accessed October 12, 2026.

Kali. n.d. “dc3dd.” Kali Linux Tools. Accessed October 12, 2026.

Kent, Karen, Suzanne Chevalier, Tim Grance, and Hung Dang. 2006. Guide to Integrating Forensic Techniques into Incident Response. NIST SP 800-86. National Institute of Standards and Technology.

Kent, Karen, and Murugiah Souppaya. 2006. Guide to Computer Security Log Management. NIST SP 800-92. National Institute of Standards and Technology.

Miao, Fuyou, Yuzhi Ma, and Joseph Salowey. 2009. Transport Layer Security (TLS) Transport Mapping for Syslog. RFC 5425. Internet Engineering Task Force.

nginx. n.d. “Module ngx_http_log_module.” nginx documentation. Accessed October 12, 2026.

OpenBSD. n.d. “sshd_config(5).” OpenBSD manual pages. Accessed October 12, 2026.

Prisaca, Dragos, Stephen Quinn, Jack Vander Pol, and Daniel Harris. 2026. Technical Specification for the Security Content Automation Protocol (SCAP): SCAP Version 1.4. NIST SP 800-126 Rev. 4.

Rigney, Carl. 2000. RADIUS Accounting. RFC 2866. Internet Engineering Task Force.

Scarfone, Karen, and Peter Mell. 2007. Guide to Intrusion Detection and Prevention Systems (IDPS). NIST SP 800-94. National Institute of Standards and Technology.

Velocidex. n.d. “WinPmem.” README, GitHub. Accessed October 12, 2026.

Volatility Foundation. 2026. “Windows Tutorial.” Volatility 3 documentation. See also “windows.malware.malfind.” Accessed October 12, 2026.