An organization experiences a cybersecurity incident involving a command-and-control server.

Network and firewall logs should be analyzed to identify the impacted host in a cybersecurity incident involving a command-and-control server. A command-and-control server is a central server that communicates with and controls malware-infected devices or bots. A command-and-control server can send commands to the bots, such as downloading additional malware, stealing data, or launching attacks. Network logs can help to identify any suspicious or anomalous network traffic, such as connections to unknown or malicious domains, high-volume data transfers, or unusual protocols or ports. Firewall logs can help to identify any blocked or allowed traffic based on the firewall rules, such as connections to or from the command-and-control server, or any attempts to bypass the firewall. References:

https://cybersecurity.att.com/blogs/security-essentials/command-and-control-server-detection-methods-best-practices

https://www.howtogeek.com/726136/what-is-a-command-and-control-server-for-malware/