Lesson 3 of 12 · Triage and logs
Triaging a suspect Linux server
Objective
Answer one question fast: is this machine compromised, and how badly? Triage reviews, in a fixed order, the places where an attacker almost always leaves a trace, before the deep investigation.
This lesson is part of the full course
Unlock Linux Incident Response and Digital Forensics to read every lesson, do the exercises, access the simulations and earn your certificate.
Already enrolled? Log in.