3 ms·
Having to sort out logs of an attacker pivoting through systems combined with logs generated by victims "hacking back" isn't going to make incident response inv
by EvanAnderson 9y ago
Having to sort out logs of an attacker pivoting through systems combined with logs generated by victims "hacking back" isn't going to make incident response investigations any easier.
- bloaf 9y agoI'm not sure. Yes, there would be more to look at, but the "qualified defender" will have already done some of the work. Assuming QDs are required to turn over info to law enforcement, all LEOs may have to do is verify the QD's analysis of events against the logs.