The keys to successful incident response equate to having the proper people, processes, and tools in place to act decisively when an incident occurs, which is a recurring theme in our incident response articles. Without proper logging occurring ahead of time, which is a large part of the picture for security operations and incident response, teams, it will make it difficult to prove how long a threat actor was in an environment, and depending on the lack of logs, could be very difficult to provide analysis on activities taken by the threat actors or insider threats depending on the case scenario.
Read the blog