# How do we find patient zero, the first machine the attacker compromised?

Work backwards from what you know, using timestamps. Start with the machine where the incident was noticed, ask which other host first connected to it in an unusual way, then repeat for that host. Endpoint logs show logins and new programs; directory logs show which account was used from which computer; firewall and VPN logs show the first outside connections. The earliest regular check-ins with an attacker's server often mark the first infected machine. Patient zero matters because it tells you how they got in, which you must close before recovery. Keep in mind that the first machine you find is often not the first one infected. NetSenX alerts carry times, hosts and destinations, and from the Pro plan network-wide correlation links scanning, new sessions and beaconing across hosts into one story, which shortens this search.

FAQ: [Incident response](https://netsenx.com/en/faq/incident) · https://netsenx.com/en/faq/how-to-find-patient-zero

## Read next

- https://netsenx.com/en/detect-ransomware-on-the-network
- https://netsenx.com/en/nis2-incident-reporting-deadlines

## Related questions

- [What is a forensic image, and when do we need one?](https://netsenx.com/en/faq/what-is-a-forensic-image)
- [What is chain of custody for digital evidence?](https://netsenx.com/en/faq/what-is-chain-of-custody-for-digital-evidence)
- [How do we preserve logs before they are overwritten?](https://netsenx.com/en/faq/how-to-preserve-logs-before-they-are-overwritten)
- [What does eradication mean in incident response?](https://netsenx.com/en/faq/what-does-eradication-mean-in-incident-response)
- [How do we reset passwords safely after a breach?](https://netsenx.com/en/faq/how-to-reset-passwords-safely-after-a-breach)