intruder clues

[Jim.Meritt () wang com (Meritt, Jim)]

Archive: http://msgs.securepoint.com/ids
FAQ: http://www.ticm.com/kb/faq/idsfaq.html
IDS: http://www-rnks.informatik.tu-cottbus.de/~sobirey/ids.html
UNSUBSCRIBE: email "unsubscribe ids" to majordomo () uow edu au
If a corporation/organization/whatever has NOT implemented an IDS, what do
you (the reader specifically) look for/at during after-the-event intrusion
detection?

I'm looking for individual responses other than real-time clues (the system
isn't even connected to the network any more) and the multitude of log files
(a system may, or may not, have varied logging enabled)

_______________________
The opinions expressed above are my own.  The facts simply are and belong to
none. 
James W. Meritt, CISSP, CISA
Senior Secure Systems Engineer at Wang Government Services, Inc.