Re: HEOA Question

[Eme Ejike <eejike () ODU EDU>]

The DMCA response processes tends to be customized to your environment 
and logging capacity.
We are able to tie user names to incidents using custom perl scripts and 
parsing algorithms that collate logs in the data collection process. The 
network Perimeter logs reports on the corresponding internal IP tied to 
the NAT at a specific time period. Hence log time frame matches.
I know this isn't a tool but it is information to point you in the right 
processing direction.

Eme Ejike
Enterprise Systems Security Officer
Old Dominion University
Norfolk,Va
757-683-6755