Enhanced Security Measures in Place:   To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.

Forensics - Data Collection [A question from a Cortex XDR CS Webinar]

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Forensics - Data Collection [A question from a Cortex XDR CS Webinar]

L5 Sessionator

Do I have to collect forensic data all the time? it's sufficient to ingest data just after an incident?

*Note: This question was asked during the Cortex XDR Customer Success Webinar: Uncover the Power of Forensics - Part 1

1 accepted solution

Accepted Solutions

L5 Sessionator

A reply by Paul Anderson:

I'd say no; it's actually really important to make sure that critical forensic artefacts are backed up at a regular cadence. The reason for this is that, firstly, for efficiency reasons, most Windows event log files will roll over at certain sizes. Also, threat actors will be 'anti-forensic' quite regularly and delete forensic artefacts to try and hide malicious activity. But, if there's no XDR platform in place, and no 'live' monitoring taking place, host-based forensics provide us with our best opportunity to get some answers.

View solution in original post

1 REPLY 1

L5 Sessionator

A reply by Paul Anderson:

I'd say no; it's actually really important to make sure that critical forensic artefacts are backed up at a regular cadence. The reason for this is that, firstly, for efficiency reasons, most Windows event log files will roll over at certain sizes. Also, threat actors will be 'anti-forensic' quite regularly and delete forensic artefacts to try and hide malicious activity. But, if there's no XDR platform in place, and no 'live' monitoring taking place, host-based forensics provide us with our best opportunity to get some answers.

  • 1 accepted solution
  • 1143 Views
  • 1 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!