The primary table of contents is 1. Introduction 2. Preparation 2.1. Security Incident Policy How to create a security incident policy from scratch - evaluating the level of the security violation and the appropriate steps - how to write down this policy And perhaps a small example 2.2. Preparing a Rescue System and Audit System A short overview of how to create an audit system with trusted binaries etc. 2.3. System Preparation This chapter shall be short. It describes only the major points of how to monitor your systems. There will be nothing about hardening Linux itself. 2.3.1. NIDS 2.3.2. Host based IDS 2.3.3. Security Scanners 2.3.4. Remote Logs 2.3.5. Surveillance and Monitoring Tools to Report Secuirty Policy Violations 3. Investigation The most important chapter. It will contain the steps: 3.1. Identifying Successful Attacks 3.2. Starting the Audit 3.3. detailed audit description, with all commands to perform and how to analyse the results - Life System 3.4. the same for the offline analysis, including deeper filesystem checks 3.5. Creating the Report 4. Recovering the System cleaning the system and making sure that this does not happen again Bibliography some online resources and books to learn more... -- Pierre Spielmann