CySA+ v4 · Objective 1.3

Investigation tools

Choose tools that answer a specific investigative question. Preserve originals, interpret structured evidence, and correlate tool output without mistaking a score for a finding.

What you will be able to do

  • Select packet, endpoint, log, and intelligence tools for a defined question.
  • Explain limitations of reputation, strings, rules, and sandbox results.
  • Recognise JSON, XML, YAML, and EVTX evidence handling requirements.
  • Describe safe decoding and scripting workflows that retain provenance.

Learn the concepts

  1. Lesson 1

    Select tools to test a hypothesis

    The strongest investigation is not the one with the most tools. It is the one that can explain which question each tool answered and what remained invisible.

    Open lesson →
  2. Lesson 2

    Interpret artifacts without changing the evidence

    Decoding, parsing, and scripting make evidence easier to examine. Keep transformations reproducible so another analyst can distinguish the original artifact from your interpretation.

    Open lesson →

Apply your judgement · Synthetic scenario

Three tools, three different answers

An analyst receives a suspicious attachment. One reputation service reports no prior results, a YARA rule matches, and the first sandbox run shows no network traffic.

File identity
Sample stored as case-218.bin; original hash recorded in case evidence
Rule result
Rule matches two embedded document-collection strings
Sandbox note
Run lasted 90 seconds; expected application dependency unavailable
Endpoint log
Recipient attempted opening the attachment; subsequent process telemetry is incomplete

Your task

  1. Explain what each tool result establishes and what it does not.
  2. Choose further analysis that respects artifact handling restrictions.
  3. Write a confidence statement and a verification step.
Compare your response

No reputation result means the service has no usable result, not that the sample is safe. The YARA match establishes its defined patterns. The sandbox’s missing dependency limits the meaning of its quiet run.

Keep the original and examine a copy using approved static tools. Review the rule conditions and available endpoint records; arrange a correctly configured isolated analysis if justified, rather than uploading restricted material or executing it locally.

The attachment remains suspicious, with incomplete evidence of execution or impact. State that uncertainty and verify endpoint process coverage and sandbox prerequisites before changing the assessment.

Put it into practice

Use these labs alongside this module.

Check your understanding

Choose the best response to each scenario, then check your reasoning. These are course practice questions.

1. A packet capture contains no relevant DNS exchange because the collection filter excluded DNS. What is the strongest conclusion?
2. A YARA rule matches an approved internal utility. What should the analyst do first?
3. A JSON log parser silently drops malformed records. Which improvement most strengthens its findings?

0 of 3 answered

← Course curriculumNext module: 1.4 →

Source reading: supplied book, chapters 3. Lessons, scenarios, and questions are original CyberCorps course material.