Timeline for Analyzing Network Anomalies for Malicious events
Current License: CC BY-SA 3.0
3 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jan 16, 2013 at 13:04 | comment | added | Jeff | Come from an operational standpoint for a moment. If I work for an IT company, a server rebooting randomly is a big deal. Sure we have redundant systems, but "it just happened" is not an acceptable answer to the IT manager. I (or an escalated group) would need to do a Root Cause Analysis of why this server went down. In my investigation, I may uncover malware, or I may just uncover a memory issue. You are correct, Reboots alone don't always give the full picture, but reboots + system performance may provide an answer. | |
| Jan 16, 2013 at 12:54 | comment | added | smttsp | only reboot wont say anything but if we listen traffic of a host for one month and find out the host slowed down for some percentage for the last 5 days, then we may be able to consider that issue more. with some more addition we may say something about infection or some other thing | |
| Jan 16, 2013 at 12:25 | history | answered | Jeff | CC BY-SA 3.0 |