Suspected Axis device compromise: preserve evidence before cleanup

Axis defines a three-stage process

Source fact: The AXIS OS Forensics Guide applies to AXIS OS products on active and long-term-support tracks. It organizes response into detection, evidence collection, and cleanup. That order is material: Axis warns that modifying or powering off a suspected device can destroy evidence.

Axis lists indicators such as access from an unknown address, unauthorized network traffic or video streaming, unexpected file transfers, configuration changes, new accounts, lost video or audio, and unknown applications. An indicator requires investigation; it is not proof by itself that a device was compromised.

The device server report contains health information, system details, configuration information, and logs. Axis identifies its downloadable archive as the primary resource for device forensic investigation. Audit logging was introduced in AXIS OS 12.7. The guide warns that a factory default clears logs held locally and recommends remote syslog to prevent that specific loss.

Cleanup depends on device capability

Axis describes factory default as the most efficient cleanup step for its devices after evidence is collected. For devices without signed OS and secure boot, Axis directs users to install the latest supported AXIS OS after factory default and monitor the device before reintroduction. For devices with signed OS and secure boot, Axis states that factory default returns the device to a guaranteed non-compromised state.

Those are product-specific statements, not a complete enterprise incident-response plan. The guide does not replace legal preservation, organizational escalation, network forensics, credential response, or continuity planning. Containment and cleanup must also account for security coverage and any operational dependency.

DSE response checklist

DSE recommendation: This is DSE operational synthesis. Preserve evidence and follow the organization’s incident authority before changing the device.

1. Open an incident record and capture reporter, time, device identity, observed indicator, site, coverage, and business impact.
2. Do not reboot, upgrade, reset, or install tools before the incident lead approves evidence collection.
3. Preserve VMS, switch, firewall, DHCP, DNS, authentication, monitoring, and remote-syslog evidence around the event.
4. Download the server report and collect available audit, system, access, certificate, application, and connection information.
5. Hash and protect collected files under the organization’s evidence-handling procedure.
6. Coordinate containment at an appropriate boundary without silently destroying coverage or evidence.
7. Identify signed-OS and secure-boot support, then follow the current model-specific Axis cleanup instructions.
8. Restore only known configuration, rotate affected credentials as authorized, validate video and events, and monitor before return.

Official references

• AXIS OS Forensics Guide — indicators, evidence-preservation order, server reports, audit logs, and cleanup.
• AXIS OS Hardening Guide — current preventive controls and remote logging context.
• Axis Security Advisories — official vulnerability and remediation notices.