A continuous security monitoring analyst notices a critical server has not reported logs to the SIEM for 72 hours. What is the MOST appropriate response?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — treat the log gap as a potential security incident, verify the server's current status, investigate why log forwarding stopped, and review any available out-of-band logs for the silent period. A 72-hour blind spot on a critical server may hide a compromise, misconfiguration, or connectivity failure, so you can't ignore it.
Full Explanation
The correct response is to treat the log gap as a potential security incident, verify the server's current status, investigate why log forwarding stopped, and review any available out-of-band logs for the silent period. Gaps in log collection from critical systems may indicate a compromised server where an attacker disabled logging, a misconfiguration, or a connectivity failure, and all possibilities must be investigated. The 72-hour blind spot may conceal malicious activity. Assuming the server was decommissioned and removing it from the asset inventory is wrong because it could mask an active compromise. Waiting another 48 hours to see if logs resume before escalating is wrong because it extends the blind spot while damage could continue. Restarting the SIEM forwarding agent on the server remotely without investigating why it stopped is wrong because it may destroy forensic evidence.