For Internet Information Service (IIS) version 7.0, the default location for web server logs is in the directory %SystemDrive%\inetpub\logs\LogFiles. Within this directory, you will find subfolders named W3SVCN, where N is a number that corresponds to the site ID of the IIS instance. These folders contain the log files for each website hosted on the server. Harley, as a SOC analyst, can investigate these logs for any anomalies by accessing this path.
References: The information provided aligns with the standard practices and configurations for IIS 7.0 as outlined in Microsoft's official documentation123. These references are part of the learning resources for understanding the management and structure of IIS logs, which are crucial for a SOC Analyst's role in monitoring and analyzing web server activity for security purposes. The EC-Council's SOC Analyst course and study guides also emphasize the importance of log file analysis in identifying and responding to security incidents.

The eradication stage is where the root cause of the incident is determined from the forensic results. This stage involves not only removing the threat from the affected systems but also identifying and fixing the vulnerabilities that were exploited. It's crucial to understand how the incident occurred to prevent future occurrences. After the containment stage, where the immediate threat is isolated, eradication ensures that the threat is completely removed and that the root cause is addressed.
References: The EC-Council's Certified Incident Handler (E|CIH) program outlines the stages of incident handling and response, which include preparation, identification, containment, eradication, recovery, and lessons learned. The eradication stage specifically deals with eliminating the threat and addressing the root cause based on forensic analysis. This information is covered in the E|CIH program and can be found in the official EC-Council learning resources1.