# Network, DNS and cross-source correlation Do not mistake the same IP or second for an evidence chain. Assess source coverage, direction, process linkage and benign alternatives together. Original AI-assisted SecNet educational content. Fictional local examples; not a standards provider publication, endorsement or compliance evidence. Page exercises do not create account progress. Sources checked: 2026-10-21 ## Limits of entity matching NAT, proxies, DHCP and shared devices can associate an IP with multiple entities. Combine time, user, device identity and source-event references. DNS resolution alone does not prove a connection; a connection alone does not prove exfiltration. Example IPs are documentation addresses, not live threat intelligence or block targets. Record source and date for any actual enrichment. ## Volume and direction A large transfer may be an approved backup. Review direction, units, process linkage, destination role and business timing. Byte counts do not identify content or harm. When relevant records are absent, retain uncertainty and specify evidence that would change the decision. Packet capture/content review require separate authority and data scope; this kit reads no PCAP. ## Gaps and clocks Interpret no-connections findings against sensor placement, retention and clock consistency. A gap in one source is not silence across the network. Separate event time from ingestion time and record uncertainty around skew. Display order for simultaneous records is not real-world ordering. Make scope-expansion rationale and ownership visible. ## Harbor-17 network hypothesis E-04 process and E-05 network records share a UTC second but lack process/session linkage. “The process sent data out” is not yet established. Source filters help locate records that may independently support the claim; they create no new evidence. Request process-network linkage, direction and business baseline. Destination198.51.100.25 is a reserved example address. ## Working sequence 1. Verify time and entity matching. 2. Distinguish DNS, connections and content. 3. Compare volume, direction and baseline. 4. Record sensor/retention gaps. 5. Report hypotheses with support and alternatives. ## 1. The same IP Shared egress may associate the same IP with different people. Require time, entity and behavioral support before attribution or harm claims. This code is a local policy model; it does not replace target/cluster testing. ### Weak implementation ```js s=>s.ipMatched ``` ### Corrected implementation ```js s=>s.ipMatched&&s.timeMatched&&s.entityMatched&&s.behaviorCorroborated ``` ### Synthetic input and actual model output ```json { "before": [ { "name": "supported-case", "input": { "ipMatched": true, "timeMatched": true, "entityMatched": true, "behaviorCorroborated": true }, "expected": true, "observed": true, "matched": true }, { "name": "shared-egress", "input": { "ipMatched": true, "timeMatched": true, "entityMatched": false, "behaviorCorroborated": false }, "expected": false, "observed": true, "matched": false }, { "name": "wrong-time", "input": { "ipMatched": true, "timeMatched": false, "entityMatched": true, "behaviorCorroborated": true }, "expected": false, "observed": true, "matched": false } ], "after": [ { "name": "supported-case", "input": { "ipMatched": true, "timeMatched": true, "entityMatched": true, "behaviorCorroborated": true }, "expected": true, "observed": true, "matched": true }, { "name": "shared-egress", "input": { "ipMatched": true, "timeMatched": true, "entityMatched": false, "behaviorCorroborated": false }, "expected": false, "observed": false, "matched": true }, { "name": "wrong-time", "input": { "ipMatched": true, "timeMatched": false, "entityMatched": true, "behaviorCorroborated": true }, "expected": false, "observed": false, "matched": true } ] } ``` ## 2. A large transfer Byte volume alone is not exfiltration. Direction, process, destination and business baseline must support the hypothesis; retain the approved-backup alternative. This code is a local policy model; it does not replace target/cluster testing. ### Weak implementation ```js s=>s.largeTransfer ``` ### Corrected implementation ```js s=>s.largeTransfer&&s.directionKnown&&s.processLinked&&s.destinationReviewed&&s.businessBaselineReviewed ``` ### Synthetic input and actual model output ```json { "before": [ { "name": "supported-case", "input": { "largeTransfer": true, "directionKnown": true, "processLinked": true, "destinationReviewed": true, "businessBaselineReviewed": true }, "expected": true, "observed": true, "matched": true }, { "name": "approved-backup", "input": { "largeTransfer": true, "directionKnown": true, "processLinked": true, "destinationReviewed": true, "businessBaselineReviewed": false }, "expected": false, "observed": true, "matched": false }, { "name": "unknown-process", "input": { "largeTransfer": true, "directionKnown": true, "processLinked": false, "destinationReviewed": true, "businessBaselineReviewed": true }, "expected": false, "observed": true, "matched": false } ], "after": [ { "name": "supported-case", "input": { "largeTransfer": true, "directionKnown": true, "processLinked": true, "destinationReviewed": true, "businessBaselineReviewed": true }, "expected": true, "observed": true, "matched": true }, { "name": "approved-backup", "input": { "largeTransfer": true, "directionKnown": true, "processLinked": true, "destinationReviewed": true, "businessBaselineReviewed": false }, "expected": false, "observed": false, "matched": true }, { "name": "unknown-process", "input": { "largeTransfer": true, "directionKnown": true, "processLinked": false, "destinationReviewed": true, "businessBaselineReviewed": true }, "expected": false, "observed": false, "matched": true } ] } ``` ## 3. No connections found An uncovered segment or expired log is not clean evidence. Verify sensor, clock and retention coverage before generalizing absence. This code is a local policy model; it does not replace target/cluster testing. ### Weak implementation ```js s=>s.noConnections ``` ### Corrected implementation ```js s=>s.noConnections&&s.sensorCovered&&s.clockReviewed&&s.retentionCoversWindow ``` ### Synthetic input and actual model output ```json { "before": [ { "name": "supported-case", "input": { "noConnections": true, "sensorCovered": true, "clockReviewed": true, "retentionCoversWindow": true }, "expected": true, "observed": true, "matched": true }, { "name": "expired-logs", "input": { "noConnections": true, "sensorCovered": true, "clockReviewed": true, "retentionCoversWindow": false }, "expected": false, "observed": true, "matched": false }, { "name": "blind-segment", "input": { "noConnections": true, "sensorCovered": false, "clockReviewed": true, "retentionCoversWindow": true }, "expected": false, "observed": true, "matched": false } ], "after": [ { "name": "supported-case", "input": { "noConnections": true, "sensorCovered": true, "clockReviewed": true, "retentionCoversWindow": true }, "expected": true, "observed": true, "matched": true }, { "name": "expired-logs", "input": { "noConnections": true, "sensorCovered": true, "clockReviewed": true, "retentionCoversWindow": false }, "expected": false, "observed": false, "matched": true }, { "name": "blind-segment", "input": { "noConnections": true, "sensorCovered": false, "clockReviewed": true, "retentionCoversWindow": true }, "expected": false, "observed": false, "matched": true } ] } ``` ## Exit evidence - Source/entity/time correlation matrix - Direction, coverage and benign-alternative record ## References - [NIST SP 800-86 · IT forensics foundation (2006)](https://csrc.nist.gov/pubs/sp/800/86/final) - [NIST SP 800-61 Rev.3 · Final April 2025](https://csrc.nist.gov/pubs/sp/800/61/r3/final)