The lifeblood of a good incident investigation is evidence from a wide range of sources. Even something like a malware infection on a host system requires corroboration from a variety of sources. One common challenge with incident response, especially in smaller networks, is how the organization handles log management. For a comprehensive investigation, incident response analysts need access to as much network data as possible. All too often, organizations do not dedicate the proper resources to enabling the comprehensive logs from network devices and other systems.
Prior to any incident, it is critical to clearly define the how and what an organization will log and as well as how it will maintain those logs. This ...
