ANNEXES 2 Unit Linux Intrusion Detection Incident Response Form UNIX LINUX INTRUSION DETECTION INCIDENT RESPONSE FORM UNIX LINUX INTRUSION DETECTION INCIDENT RESPONSE FORM INFORMATION FOR ANALYSIS     GENERAL INFORMATION         Name:   Run the following commands and save the results to a TXT file.     FOLIO:                                                                                   Position:                 Command Identification of the operating system                      Contact  Phone  No:     Office:       Institutional  e-­‐mail:                     Personal  e-­‐mail  (optional):                       of  the  Case  or  Incident:           Agent               Date  and  Time  of  Report:       Brief  description  of  the  facts:                                       GENERAL INFORMATION OF THE COMPROMISED EQUIPMENT                         Operating   System:                 Hard  Drive  Capacity:                               Kernel  Version:           Time  Zone  of  the  Compromised  System:                           Additional  Information:                       Name of equipment lscpu Kernel information lsb_release –a Displays distribution and system version date Current date and time of the system (option –u shows universal time zone) who -b Date and time the system was started df –h Hard drive information fdisk -l List of partitions per disk (root) free –o –m State of RAM and SWAP memory smbclient –L nom-equipo See which shared resources are on the equipment Red Hat: net –l share –S nomequipo dumpe2fs -h /dev/sda1 | grep created ls -lct /etc/ | tail -1 | awk '{print $6. $7, $8}'     Date of operating system installation (root) The install.log file provides information on when the OS was installed Red Hat: install.log                         Mount   1 94 hostname dmes | grep hd                 Network  Interfaces  (add  IP  addresses):       Provides: Name, version, date and time of installation hdparm [/dev/DISCO]       RAM  Capacity:           uname -a RedHat: cat /etc/redhat-release     Description Devices mounted on the system 2 95