A full network forensics was identified for further analysis and data exfiltration. We'll be conducting a tabletop exercise to simulate this ransomware scenario next this morning.

Thanks for sharing this information about network monitoring. It's very helpful. What tools are people using these days for log analysis? Still CrowdStrike or something else? Thanks for sharing...

robert53 wrote:

I'm not convinced that control-based is the best solution for insufficient logging.

Our after-action report identified 2025-045...