The subspecialty of understanding what happened to a computer by focusing on logs of network data traffic.