Title: Explore data sources to support a security incident investigation.
Course: Cybersecurity Operations, Advanced (10302-III) > Section: Exploring Operations and Incident Response

Exploration should include

- vulnerability scan output
- security information and event management (SIEM) dashboards
- log files
  - network device logs
  - system logs
  - application logs
  - security logs
  - web server logs
  - DNS logs
  - log retention
  - NetFlow/sFlow.