🛡️ Security

Forensic Triage

A rapid, structured assessment of whether a system was compromised, performed alongside patching rather than after it. It prioritizes evidence the attacker could not have altered, such as network egress and authentication logs on other systems, over the affected host's own logs.

📚 Deep Dive

Learn Article

How to Check an Email Security Gateway for Compromise After a Zero-Day

The vendor's grep command is where the check starts, not where it ends. A root-level attacker can edit the appliance's logs, so the real evidence lives in egress, directory, and flow data.

intermediate 6 min read

Back to Glossary