Achieve Situational Awareness

If you administer or manage endpoints, you probably have discovered an infected or compromised system. Your !rst reaction is to !nd the system and clean it, so that it does not affect your other systems, and the user can get back to work. Your second reaction is probably “how did this system get infected or compromised?” Unfortunately, most organizations do not have the ability to easily piece together all the information needed to understand an infection incident such as this. If just a single system is affected, it is a luxury for an administrator to track down the root cause—a luxury few can or choose to afford.