Logs tell you what systems recorded about themselves. Network traffic shows you what actually moved between them. Attackers can delete or alter a log, but a packet that crossed the wire is much harder to hide, which is why analysts turn to traffic when they need to confirm what really happened.
You'll start with packet capture and Wireshark, learning how to read packets and apply filters. Then you'll practise identifying hosts on a network, learn what normal activity looks like so that unusual traffic stands out, and finish by examining malicious traffic from real malware infections.
Once you're comfortable here, move on to Endpoint Detection & Response to look at what happens on the machines themselves.
An introduction to capturing and reading network traffic in Wireshark, including filters, reviewing individual packets, and a first look at suspicious activity.
How to work out which devices and users are behind the IP addresses in a capture, the first step when investigating suspicious traffic.
What everyday, non-malicious traffic looks like in a capture, so that you can tell it apart from genuine signs of compromise.
An introduction to the traffic patterns left behind by Windows malware infections and how to recognise them in a packet capture.