Documenting all Failed Attempts

---

All detected violations must be registered in special logs. You can initiate various response procedures based on the registered data. However, practical experience has shown that you can not always be sure that there has been an attack on specific resources of your corporate network. Sometimes specific events might seem suspicious, and these suspicions must not be neglected. You should document any suspicious events so that when additional information is collected, you can return to them and perform a more detailed investigation.

The same log that contains registered attacks and attack attempts must contain the actions taken during the incident investigation and response, and should carefully document the result of these actions. If attacks continue, this will help you to quickly reproduce the most efficient counteraction measures.

---