Network triage and correlation

Establish

Dimension	Check
Endpoint	Source/destination IP, host, interface, NAT
Transport	Direction, protocol, ports, state
Volume	Bytes, packets, duration, frequency
Name	DNS query/response, CNAME chain, first seen
TLS	SNI, certificate, issuer, JA3/JA4 where available
HTTP	Host, URI, method, status, User-Agent, referrer
Process/user	Responsible process, lineage, account/session
Baseline	Peer prevalence, periodicity, normal destination/category

Suspicious patterns

• Regular low-volume beaconing or unusual long-lived sessions
• Rare destination or first-seen domain for a host/user
• DNS immediately followed by connection from an unexpected process
• Office/script/system utility making external connections
• New certificate/fingerprint or domain-to-shared-hosting mismatch
• High outbound bytes, unusual upload method, or many small staged transfers
• Connection after authentication, process injection, or persistence event

Pivot flow

Alert/flow
  → identify host and process
  → resolve user/session and lineage
  → reconstruct DNS/TLS/HTTP
  → find destination history and peer scope
  → correlate file, auth, and cloud activity
  → determine intent and impact