title: web logic server Breach Help! How do Find Signs of what data if any was accessed?
body: <p>A Weblogic server got hacked and the problem is now removed. 
  I am looking through the infected VM's now in a sandbox and want to see what if any data was accessed on the application servers. 
  the app servers were getting hammered with ssh requests and so we identified the infected VM's as the web logic VMS, we did not have http logging on. Is there any way to Identify if any PII was Compromised? </p>
  
  <p>Looked through secure logs on weblogic as well as looked through the PIA logs
  I am not sure how to identify what if any data was accessed</p>
  
  <p>I would like to find out what went out of our network and info or data </p>
  
  <p>what should I be looking for </p>
  
  <p>is there anything I can learn from looking at the weblogic servers running on red hat?</p>