Showing 13–14 of 14 articles
Page 2 of 2
Incident logs: collect the evidence that answers your questions
A useful log source answers a specific incident question. Start with identities, affected services, and the actions you need to reconstruct, then preserve the records with their time context.
Read the visual guide
Web shells: remove the attacker’s access, not just one file
An unexpected server-side script may provide an attacker with continuing access. Removing that file is only one step; you also need to understand how it arrived and what else changed.
Read the visual guide