Forensics - Data Collection [A question from a Cortex XDR CS Webinar]

rtsedaka — Thu, 28 Sep 2023 18:36:17 GMT

Do I have to collect forensic data all the time? it's sufficient to ingest data just after an incident?

*Note: This question was asked during the Cortex XDR Customer Success Webinar: Uncover the Power of Forensics - Part 1

Re: Forensics - Data Collection [A question from a Cortex XDR CS Webinar]

rtsedaka — Thu, 28 Sep 2023 18:37:17 GMT

A reply by Paul Anderson:

I'd say no; it's actually really important to make sure that critical forensic artefacts are backed up at a regular cadence. The reason for this is that, firstly, for efficiency reasons, most Windows event log files will roll over at certain sizes. Also, threat actors will be 'anti-forensic' quite regularly and delete forensic artefacts to try and hide malicious activity. But, if there's no XDR platform in place, and no 'live' monitoring taking place, host-based forensics provide us with our best opportunity to get some answers.

topic Re: Forensics - Data Collection [A question from a Cortex XDR CS Webinar] in Cortex XDR Discussions

Forensics - Data Collection [A question from a Cortex XDR CS Webinar]

Re: Forensics - Data Collection [A question from a Cortex XDR CS Webinar]