Network throughput logs? System logs and events sent to a separate log aggregator? System metric logs showing disk i/o? There is some commands in here https://w

Network throughput logs? System logs and events sent to a separate log aggregator? System metric logs showing disk i/o? There is some commands in here https://www.sans.org/reading-room/whitepapers/incident/paper/33901 https://www.sans.org/reading-room/whitepapers/incident/paper...