HARBOR-17 / 05 / PRACTICE GUIDE

Network, DNS and cross-source correlation

Do not mistake the same IP or second for an evidence chain. Assess source coverage, direction, process linkage and benign alternatives together.

Download guide and workpapers

Original AI-assisted SecNet educational content; examples are fictional. Not a source organization publication or endorsement. Sources checked: 2026-10-21.

EVIDENCE REVIEW DESK

Move from observations to decisions.

Code here is a local policy model with no target connection. Passing model cases are not security approval or device tests.

The same IP / Incomplete decision

Inspect an incomplete decision based on record existence or another positive signal. Consider denial cases alongside permitted use.

s=>s.ipMatched

Shared egress may associate the same IP with different people. Require time, entity and behavioral support before attribution or harm claims.

Choices and outputs last only on this open page; they do not update account progress, career status, points or certificates.

01 / EXPLANATION

Limits of entity matching

NAT, proxies, DHCP and shared devices can associate an IP with multiple entities. Combine time, user, device identity and source-event references. DNS resolution alone does not prove a connection; a connection alone does not prove exfiltration. Example IPs are documentation addresses, not live threat intelligence or block targets. Record source and date for any actual enrichment.

02 / EXPLANATION

Volume and direction

A large transfer may be an approved backup. Review direction, units, process linkage, destination role and business timing. Byte counts do not identify content or harm. When relevant records are absent, retain uncertainty and specify evidence that would change the decision. Packet capture/content review require separate authority and data scope; this kit reads no PCAP.

03 / EXPLANATION

Gaps and clocks

Interpret no-connections findings against sensor placement, retention and clock consistency. A gap in one source is not silence across the network. Separate event time from ingestion time and record uncertainty around skew. Display order for simultaneous records is not real-world ordering. Make scope-expansion rationale and ownership visible.

04 / EXPLANATION

Harbor-17 network hypothesis

E-04 process and E-05 network records share a UTC second but lack process/session linkage. “The process sent data out” is not yet established. Source filters help locate records that may independently support the claim; they create no new evidence. Request process-network linkage, direction and business baseline. Destination198.51.100.25 is a reserved example address.

Build the evidence yourself.

Blank workpapers are not completed tests. Fill them in your authorized environment without secrets or real personal data.

Case scope and collection authorityMarkdown · EN Hypothesis and evidence collection planMarkdown · EN Observation, hypothesis and gap recordMarkdown · EN Response and closure decisionMarkdown · EN

Full guide with code, outputs and reasoning ↓

Primary references

Explanations are authored by SecNet. References support method and platform context; verify current editions and organizational policy for real use.