Good words here. Unfortunately I’ve been involved in far too many IRs where the victim is unable to provide the information the reputable IR firm needs.
Because predatory companies are taking advantage of the many ransomware victims out there these days, I wrote some basic expectations you should have of your contracted IR team and why, from the perspective of an incident responder. tisiphone.net/2021/05/11/rea… via tisiphone-net

May 11, 2021 · 8:15 PM UTC

2
2
12
Replying to @hal_pomeranz
Would a list of “must have” data fit into a tweet? FWIW, here is my list: Sysmon logs, Zeek logs, Windows Events, Linux logs, Firewall logs, Honeypot logs + list of all machines & owners.
1
5
What you get is whatever Windows event logs and Linux logs happen to be on each system. Plus one random collection of network logs (firewall, CloudTrail, etc) and you don’t get to pick which one. Welcome to my world!
1
1