Incident-based security control validation
Reconcile what the packets show, what the control recorded, and what the endpoint experienced. Pinpoint whether the gap was visibility, recognition, policy, action delivery, or endpoint response.
Post-event validation for the security controls you already operate.
Did the traffic reach the firewall, match the expected rule or ACL, and get effectively blocked?
Four recurring investigation jobs
Four recurring investigations that turn a disputed outcome into a reviewable next action.
Reconcile traffic recognition, the control decision, the wire action, its delivery path, and the endpoint outcome.
policy context · RST/drop evidence · endpoint outcomeIdentify one-way visibility, bypass, asymmetric VLAN or tunnel handling, missing handshakes, and the next useful capture boundary before deeper analysis continues.
vantage map · direction coverage · next capture pointTest the protocol label, signature boundary, flow role, malformed input, and whether the proposed indicator is precise enough to enforce safely.
matched bytes · semantic validity · supported dispositionLook for duplicate feeds, flow churn, reset saturation, overload bypass, selective loss, and classification work that changes enforcement under load.
rate timeline · duplicate evidence · coverage boundaryOne outcome · several evidence boundaries
Capture direction, observation point, VLAN or tunnel context, handshake coverage, and missing path.
Protocol semantics, application indicators, malformed fields, flow role, and exact packet sequence.
Confirm the matched rule, policy decision, and selected action with the available control records.
Injected reset, reject, redirect, proxy exchange, retransmission behavior, timing, and appliance-side observation.
Client or server observation, continued application traffic, fallback behavior, retry, closure, or successful session.
Responsible attribution may require a PCAP from more than one observation point plus control logs, configuration, or endpoint evidence. Missing sources remain explicit instead of being inferred from packet silence.
Representative cases
Each pattern connects the reported symptom to the evidence and next action.
The policy log records a deny while the client continues exchanging application data.
Compare the log time and rule context with appliance-side and endpoint-side captures. Verify whether an action appears, when it appears, and whether the endpoint receives it.
A bounded failing stage, contradictory evidence, or a precise request for the missing observation point.
Traffic uses a familiar port and receives a protocol label, but required fields are malformed or semantically impossible.
Keep the dissector label separate from protocol validity. Inspect the matched bytes, malformed ratio, request/response structure, and negative controls.
Alert supported, rebutted, narrowed, or left inconclusive without converting missing evidence into a clean result.
Packet analysis identifies the traffic, but the deployed control applies a different label or does not enforce the expected policy.
Compare packet-derived identity with deployed classification, policy mapping, and runtime state.
Localize the discrepancy to traffic recognition, deployment state, policy mapping, or enforcement.
The indicator matches the target traffic but also appears on shared infrastructure or legitimate application flows.
Test the exact match scope, protocol validity, endpoint role, and expected collateral impact.
A supported rule, a narrower condition, or an explicit unsafe-to-enforce conclusion.
The client retries or times out, while the available appliance capture contains only one side of the exchange.
Map capture location, direction, encapsulation, handshake coverage, and route asymmetry before attributing the failure to parsing or policy.
The next capture boundary and owner are named instead of repeating an unfocused packet collection.
Recognition or enforcement works in a small reproduction but fails during a high-rate production event.
Compare rate, flow cardinality, duplicate traffic, loss, resets, bypass indicators, and successful low-rate controls.
A supported scale-sensitive mechanism or an explicit requirement for appliance telemetry and controlled reproduction.
One qualified evaluation case
Success is a decision-changing result: a supported conclusion, the next required capture, or the component that needs attention.
Choose a representative incident with an operational question, authorized PCAPs, observation points, and any available rule or alert context.
Capture expert touch time, packet pivots, recaptures, team handoffs, current hypothesis, and what evidence the team would accept.
Measure time to useful direction, exact packet support, coverage limits, rejected alternatives, and whether the next action is obtainable.
Ask the control owner and service owner whether the result changes an action, closes a dispute, or defines the next evidence.
Bring the contradiction