When reporting on a major incident it is important to record the timelines. The best method to have these times is to use a screen capture tool. Alternative methods of determining these times is:- If the major incident involved a server check the event log for the logon/logoff messages of RDP and use the times logged as a guideline. Make certain that the policy for auditing successful logons is enabled for all servers. The event logs can also be mined for other information.
- If the major incident involved network equipment use a client like Putty. Putty allows the whole session to be logged. It is a good idea to have logging permanently enabled for Putty. If you have a Cisco ACS server, it is possible to configure the network equipment to log all access and commands issued. Additional, the network equipment can be mined for syslog information either by configuring a logging buffer on the device or sending the syslogs to a daemon like Kiwi.
- If you worked on a system that had a web front end, check your browser history. Web Historian is a good tool to do this task.
Comments
Post a Comment