<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Network Forensics Blog &#187; Network Forensics</title>
	<atom:link href="http://www.networkforensics.com/category/networkforensics/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.networkforensics.com</link>
	<description></description>
	<lastBuildDate>Fri, 03 Sep 2010 18:48:14 +0000</lastBuildDate>
	<generator>http://wordpress.org/?v=2.9.1</generator>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
			<item>
		<title>Leveraging Custom Actions in NetWitness Investigator</title>
		<link>http://www.networkforensics.com/2010/08/30/leveraging-custom-actions-in-netwitness-investigator/</link>
		<comments>http://www.networkforensics.com/2010/08/30/leveraging-custom-actions-in-netwitness-investigator/#comments</comments>
		<pubDate>Mon, 30 Aug 2010 17:19:33 +0000</pubDate>
		<dc:creator>alex</dc:creator>
				<category><![CDATA[Malware Analysis]]></category>
		<category><![CDATA[Network Forensics]]></category>
		<category><![CDATA[Network Visbility]]></category>
		<category><![CDATA[Situational Awareness]]></category>
		<category><![CDATA[pentesting]]></category>

		<guid isPermaLink="false">http://www.networkforensics.com/?p=393</guid>
		<description><![CDATA[One of the lesser-known features that was recently introduced in NetWitness Investigator are Custom Actions.   Have you ever been analyzing a pcap in Investigator and thought &#8220;I wish there was an easy way to push this information into another system&#8230;&#8221;.   Custom Actions is a flexible extension system that will allow you to do [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2010/08/30/leveraging-custom-actions-in-netwitness-investigator/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>They are watching you&#8230;and your security vendors.</title>
		<link>http://www.networkforensics.com/2010/05/30/they-are-watching-you-and-your-security-vendors/</link>
		<comments>http://www.networkforensics.com/2010/05/30/they-are-watching-you-and-your-security-vendors/#comments</comments>
		<pubDate>Sun, 30 May 2010 13:32:43 +0000</pubDate>
		<dc:creator>alex</dc:creator>
				<category><![CDATA[Advanced Threats]]></category>
		<category><![CDATA[Gumblar]]></category>
		<category><![CDATA[Malware Analysis]]></category>
		<category><![CDATA[Martuz]]></category>
		<category><![CDATA[Network Forensics]]></category>
		<category><![CDATA[bluehost]]></category>
		<category><![CDATA[cybercrime]]></category>
		<category><![CDATA[godaddy]]></category>
		<category><![CDATA[hacked]]></category>
		<category><![CDATA[hostgator]]></category>
		<category><![CDATA[network solutions]]></category>
		<category><![CDATA[trojan]]></category>
		<category><![CDATA[wordpress]]></category>
		<category><![CDATA[botnets]]></category>
		<category><![CDATA[e-crime]]></category>
		<category><![CDATA[malware]]></category>
		<category><![CDATA[network forensics]]></category>

		<guid isPermaLink="false">http://www.networkforensics.com/?p=309</guid>
		<description><![CDATA[If you&#8217;ve ever seen me, or any of the NetWitness crew, speak on malware, advanced threats or the current threat environment, you&#8217;ll generally hear more than one recurring theme, one of which is:
Your anti-virus solution isn&#8217;t working like you think it is.
This is occurring for a variety of reasons and is ultimately the result of a business-based [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2010/05/30/they-are-watching-you-and-your-security-vendors/feed/</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
		<item>
		<title>Network detection of x86 buffer overflow shellcode</title>
		<link>http://www.networkforensics.com/2010/05/16/network-detection-of-x86-buffer-overflow-shellcode/</link>
		<comments>http://www.networkforensics.com/2010/05/16/network-detection-of-x86-buffer-overflow-shellcode/#comments</comments>
		<pubDate>Sun, 16 May 2010 17:32:54 +0000</pubDate>
		<dc:creator>Gary Golomb</dc:creator>
				<category><![CDATA[Advanced Threats]]></category>
		<category><![CDATA[Breach]]></category>
		<category><![CDATA[Malware Analysis]]></category>
		<category><![CDATA[Network Forensics]]></category>
		<category><![CDATA[Network Visbility]]></category>
		<category><![CDATA[network forensics]]></category>
		<category><![CDATA[agility]]></category>
		<category><![CDATA[flex parser]]></category>
		<category><![CDATA[malware]]></category>

		<guid isPermaLink="false">http://www.networkforensics.com/?p=297</guid>
		<description><![CDATA[Overview
This technique can detect overflow exploits against software running on the x86 platform, meaning it applies to Windows, Unix, and Mac shellcode. It not only works independently of OS, but it also works for finding both stack and heap based overflows. Most interestingly, it catches most forms of polymorphic shellcode as well. (Actually, it exceeds [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2010/05/16/network-detection-of-x86-buffer-overflow-shellcode/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>There is an &#8220;O&#8221;  in I/O &#8230;</title>
		<link>http://www.networkforensics.com/2010/04/28/there-is-an-o-in-io/</link>
		<comments>http://www.networkforensics.com/2010/04/28/there-is-an-o-in-io/#comments</comments>
		<pubDate>Wed, 28 Apr 2010 14:05:24 +0000</pubDate>
		<dc:creator>brian</dc:creator>
				<category><![CDATA[Competitor Hype]]></category>
		<category><![CDATA[Network Forensics]]></category>
		<category><![CDATA[Performance]]></category>
		<category><![CDATA[Situational Awareness]]></category>
		<category><![CDATA[agility]]></category>

		<guid isPermaLink="false">http://www.networkforensics.com/?p=278</guid>
		<description><![CDATA[I spent a good amount of time this week speaking to customers, partners and prospects about deploying, engineering and using our products &#8212; one topic that always seems to be part of the discussion is system throughput and scalability.  Of course our position regarding this is clear, as NetWitness technology was designed from inception to [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2010/04/28/there-is-an-o-in-io/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Move over China, here comes Russia</title>
		<link>http://www.networkforensics.com/2010/02/18/move-over-china-here-comes-russia/</link>
		<comments>http://www.networkforensics.com/2010/02/18/move-over-china-here-comes-russia/#comments</comments>
		<pubDate>Thu, 18 Feb 2010 03:10:53 +0000</pubDate>
		<dc:creator>tim</dc:creator>
				<category><![CDATA[Advanced Threats]]></category>
		<category><![CDATA[Data Leakage]]></category>
		<category><![CDATA[Malware Analysis]]></category>
		<category><![CDATA[Network Forensics]]></category>
		<category><![CDATA[Network Visbility]]></category>
		<category><![CDATA[Situational Awareness]]></category>
		<category><![CDATA[cybercrime]]></category>
		<category><![CDATA[apt]]></category>
		<category><![CDATA[botnets]]></category>
		<category><![CDATA[Cyberwar]]></category>
		<category><![CDATA[e-crime]]></category>
		<category><![CDATA[malware]]></category>
		<category><![CDATA[network forensics]]></category>

		<guid isPermaLink="false">http://www.networkforensics.com/?p=187</guid>
		<description><![CDATA[While the world took pause to consider the implications of Operation Aurora, and Google lent considerable voice to the concept of Advanced and Persistent Threats (APT), we can ill-afford to believe even for a moment that they are alone in their sophistication or capability.   According to the FBI more than 100 nations have offensive [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2010/02/18/move-over-china-here-comes-russia/feed/</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
		<item>
		<title>Network Forensics ca. 1999</title>
		<link>http://www.networkforensics.com/2010/02/02/network-forensics-ca-1999/</link>
		<comments>http://www.networkforensics.com/2010/02/02/network-forensics-ca-1999/#comments</comments>
		<pubDate>Tue, 02 Feb 2010 17:07:10 +0000</pubDate>
		<dc:creator>brian</dc:creator>
				<category><![CDATA[Competitor Hype]]></category>
		<category><![CDATA[Leadership]]></category>
		<category><![CDATA[Network Forensics]]></category>
		<category><![CDATA[Situational Awareness]]></category>
		<category><![CDATA[agility]]></category>
		<category><![CDATA[Investigator]]></category>
		<category><![CDATA[network forensics]]></category>

		<guid isPermaLink="false">http://www.networkforensics.com/?p=135</guid>
		<description><![CDATA[It’s a little known fact that NetWitness has been innovating in the security field for over 11 years, which was further validated by the announcement of our recently granted US Patent # 7,634,557. Clearly, when it comes to network analysis we do it better than anyone else, and it’s really the only way to get [...]]]></description>
		<wfw:commentRss>http://www.networkforensics.com/2010/02/02/network-forensics-ca-1999/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>
