- Training
- Training Live Events
- Training Without Travel
- SANS Courses
- Certified Instructors
- Career Roadmap
- Training Calendars
- SANS @Home
- SANS OnDemand
- Community SANS
- SANS Mentor Program
- SANS Onsite
- SANS SelfStudy
- SANS Partnership Series
- SANS Workshop Series
- Webcasts
- Work Study
- Events Archive
- DoD 8570
- Voucher Credit Program
- Certification
- Resources
- Vendor
- Portal
- Storm Center
- College
- Developer
- About
the most trusted source for computer security training, certification and research
Baselines and Incident Handling
- Abstract
- The purpose of this paper is to explain why the establishment of baselines is an important part of incident handling and how doing so can be a useful tool for an incident handler during incident handling process. Examples will be given regarding how to establish baselines on various types of systems and network equipment. Also, demonstrations will be given showing what to look for when attempting to identify, using baselines, whether an incident has occurred.