Begin with the reason
An investigation should make clear why it exists. Start from a trusted alert, event, cloud finding, threat match, hunt result, or business question. Record the affected scope, initial evidence, time window, immediate risk, and decision that the investigation must support.
Build the case without losing evidence
- Preserve original records and source references before summarizing them.
- Build a chronology that separates observed events from inferred sequence.
- Follow affected users, assets, addresses, processes, cloud resources, data, and relationships.
- Record supporting evidence, conflicting evidence, duplicates, coverage gaps, and unresolved questions.
- Keep ownership, decisions, requested actions, and reported outcomes in the same investigation history.
Record the investigation findings
- Observed facts
- What the retained source evidence directly shows within the stated scope and time.
- Supported conclusions
- What the evidence reasonably supports, with confidence and reasoning visible.
- Unknowns
- Important questions that available evidence cannot yet answer.
- Decision
- The analyst’s current disposition and the justified next step.
- Outcome
- What was reported after the approved work completed or failed.