In this presentation, we introduce a new approach to analyzing network traffic data using associations. In the beginning, we discuss the benefits and issues of currently used analysis tools. Next, we propose a new data representation model and utilization of a graph database to store such data. In the main part of the presentation, we introduce the Granef toolkit and its use for incident investigation.