Logs from servers, firewalls, Active Directory, intrusion detection systems (IDS) and endpoint tools are usually the easiest to get and first ingested. Many other sources are invaluable for incident response (IR), but rarely ingested because of the level of effort involved. To maximize benefits of logging efforts, enterprise organizations must evaluate and adapt existing processes to fit current needs and threats, and consider logging additional — often overlooked — sources that could provide a huge benefit for IR and HUNT exercises. This document details these key activities and identifies their threats to assist IT leaders in maximizing logging and monitoring return on investment (ROI), but is by no means an exhaustive list of all recommended logging activities.
Learn More
0 comments:
Post a Comment