Guidelines for Evidence Collection and Archiving Status of this Memo This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements. Distribution of this memo is unlimited.
Tom Killalea · 2002
A incident as defined in the Internet Security Glossary, RFC 2828, is a security-relevant system event in which the system’s security policy is disobeyed or otherwise breached. The purpose of this document is to provide System Administrators with guidelines on the collection and archiving of evidence relevant to such a security incident.