In this final exercise I reviewed and polished my four journal entries, added a reflective note on my learning journey, and completed the self-assessment. This ensures my incident handler’s journal is complete, consistent, and ready for my professional portfolio.
Over the course of the course, I captured investigation steps and tool exercises in my incident handler’s journal template. Now I’ve gone back through each entry to fill out all fields—dates, entry numbers, full descriptions, the 5 W’s, and tools used—then added a reflections section.
| Date | 2025-06-10 |
|---|---|
| Entry | 1 |
| Description | I documented a ransomware attack on a clinic, summarizing how patient records were encrypted and operations halted. |
| Tool(s) used | Incident handler’s journal template, security console logs |
| The 5 W’s |
|
| Additional notes | Emergency systems were offline; notified IT director and compliance team. |
| Date | 2025-06-12 |
|---|---|
| Entry | 2 |
| Description | I analyzed a packet capture with Wireshark, filtering HTTP and DNS traffic to identify client and server IPs. |
| Tool(s) used | Wireshark, BPF display filters |
| The 5 W’s |
|
| Additional notes | Noted HTTP GETs to example.com; DNS TTL values examined. |
| Date | 2025-06-14 |
|---|---|
| Entry | 3 |
| Description | I captured live Linux traffic with tcpdump, filtered HTTP port 80 and DNS port 53, and saved the pcap for offline review. |
| Tool(s) used | tcpdump (live capture, read and write pcap) |
| The 5 W’s |
|
| Additional notes | Used filters port 80 and udp port 53; saw expected DNS queries. |
| Date | 2025-06-16 |
|---|---|
| Entry | 4 |
| Description | I created, tested, and verified a custom Suricata rule to detect HTTP requests to example.com in a sample pcap. |
| Tool(s) used | Suricata, custom.rules, fast.log, eve.json |
| The 5 W’s |
|
| Additional notes | Rule sid:1000001 fired twice; confirmed in both log formats. |
Writing these entries helped me see how each tool fits into a real investigation. I found tcpdump’s simplicity very powerful for quick captures, while Wireshark’s GUI gave me deeper packet insights. Crafting Suricata rules reinforced how signatures map to alerts, and maintaining a structured journal keeps my process transparent and reproducible.
By fully updating each entry and adding my reflections, I’ve ensured my incident handler’s journal is complete, accurate, and ready to share as part of my cybersecurity portfolio.