What logs would be useful for an incident investigation?
At the least, the web server’s access and error logs are required. These permit the security response team to see what URLs were requested at what time by whom, as well as any error conditions that were reported as a result of these requests. Many attackers evaluate your server’s response to invalid requests in order to learn of mistakes or vulnerabilities in your configuration.
Related Questions
- Prior to the background investigation process beginning, what if I have concerns about an incident or incidents that occurred in my life, such as previous arrest or use of drugs?
- Is this private investigation software a useful search tool in an investigators toolbox?
- What is a Major Unusual Incident (MUI) Investigation?
