iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
An alert is not proof that your organization was hacked, and the absence of an alert is not proof that it was safe. A defensible assessment requires a documented investigation: validate the signal, compare it with authorized activity and normal baselines, examine perimeter, network, endpoint, identity, cloud and operational-technology evidence, preserve volatile data, determine access and impact, then contain and report according to your response plan and legal duties.
Use the sequence below to move from a report or suspicious indicator to one of three clearly supported positions: an unconfirmed alert, verified malicious activity, or confirmed compromise and impact. Record what is known, what evidence supports it, and what remains unknowable because of missing or expired telemetry.
1. Activate the incident-response process
Start by notifying the incident lead named in your organization’s response plan. Bring in the people needed for the facts and the consequences: security, infrastructure, identity, cloud, operational technology, business owners, leadership, legal, communications, insurance contacts and business-continuity staff. Do not let an individual analyst make irreversible changes without knowing who has authority to approve them.
Open an incident record immediately. At minimum, capture:
#1 Best Overall
- This comprehensive forensic imaging kit includes four different Tableau write-block bridges, a variety of adapters to support most common device interfaces, and durable SiForce Rugged Case.
- Tableau write-block bridges included: T8u (USB 3.0), T7u (PCIe), T35u (SATA/IDE), and T6u (SAS).
- PCIe Adapters (Compatible with T7u) Include: TDA7-1 PCIe Card SSD Adapter, TDA7-2 M.2 PCIe SSD Adapter, TDA7-3 Apple SSD 2013-2016 Adapter, TDA7-4 U.2 PCIE SSD Adapter, TDA7-7 Apple SSD 2016+ Adapter, PCIE-4 Tableau Pigtail Cable.
- Other Adapters/Components Include: Tableau TDA3-3 mSATA/m.2 SATA SSD Adapter (Compatible with T35u), SiForce USB Media Card Reader (Compatible with T8u), TC3-8 SATA Signal Cable, TC4-8-R2 Unified SAS Cable, TC5-8-2 SATA to 2M Drive Power Cable, TC6-8 IDE Cable, TC2-8-R2 Molex Drive Power Cable, TC-USB3 USB 3.0 A to B Cable (x2), TP2 Tableau Power Supply with A/C Power Cord (x2), and SiForce Rugged Case.
- Kit List: T8u, T7u, T35u, T6u, TKDA-PCIE-5PC (TDA7-1, TDA7-2, TDA7-3, TDA7-4, TDA7-7, PCIE-4), TC3-8, TC4-8-R2, TC5-8-R2, TC6-8, TC2-8-R2, TP2 + AC power cord (x2), TC-USB3 (x2),TDA3-3, SiForce USB Media Card Reader, and SiForce Rugged Case.
- the date, time and time zone of the report;
- who reported it and how it was detected;
- the affected account, device, application, network, cloud tenant or business service;
- the original indicator, alert text, file hash, domain, address, message or other artifact;
- what was done before the incident process was activated; and
- which services or business functions might be unavailable or at risk.
The Cybersecurity and Infrastructure Security Agency (CISA) recommends established logging and monitoring practices and a crisis-response team with defined roles. If your plan specifies an incident commander, evidence custodian or communications lead, assign those roles now rather than improvising them later.
Protect the investigation from confusion
Use a single case identifier and a shared, access-controlled record. Give every entry an author and timestamp. Separate observations from assumptions: “authentication from an unfamiliar country at 02:14 UTC” is an observation; “the account was stolen” is a hypothesis. This discipline prevents an early guess from becoming the official conclusion.
2. Validate and triage the signal
First determine exactly what generated the alert and what it actually proves. Ask when the activity occurred, which account or asset was involved, what rule or sensor fired, and whether the underlying log is complete. Export the original alert and relevant raw records before a retention period removes them.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Deconflict authorized activity
Check maintenance windows, vulnerability scans, penetration tests, administrator sessions, automated service accounts, software deployment, backup jobs and changes approved by a third party. CISA identifies deconflicting suspected activity with authorized actions as a core part of accurate incident assessment. Confirm with the person or team responsible; do not mark an event benign solely because an account has administrative privileges.
Compare with a known baseline
Compare the event with normal behavior for that user, device, application and location. Useful questions include:
- Has this account used the same protocol, application and device before?
- Is the source address associated with a corporate egress point, approved remote-access service or known provider?
- Did the event occur during the user’s normal schedule and expected time zone?
- Did a software release, configuration change or scheduled job create the same pattern?
- Are related events present for other accounts or assets?
A missing alert does not establish safety. Visibility depends on which systems log, how clocks are synchronized, whether logs reach a central store and how long they are retained. State that limitation in the case record.
Assign a provisional status
Use a provisional label that can change as evidence improves:
- Unconfirmed alert: a signal exists, but authorized activity or insufficient evidence prevents a malicious-activity finding.
- Verified malicious activity: the behavior is inconsistent with authorized use and is supported by reliable telemetry, but impact is not yet established.
- Confirmed compromise and impact: evidence shows unauthorized access or execution and identifies affected credentials, assets, data or services.
Record the evidence and uncertainty for each label. Do not describe an event as “resolved” merely because a detection stopped.
3. Scope the environment systematically
Scope is broader than the machine that produced the first alert. Work outward from the initial indicator and examine every environment that could have received, issued or amplified the activity.
Perimeter and network
Review firewall, intrusion-detection, virtual-private-network, proxy, router, DNS, email-security and other boundary records. Look for the same source, destination, protocol, user, certificate, domain or file across the period before and after the alert. Check both successful and blocked connections; repeated blocked attempts can explain later successful access from a different address.
Internal systems and identity
Search authentication, directory, privilege-change, remote-management, ticketing and application-audit logs. Identify new accounts, changed credentials, added group membership, unusual token issuance, disabled controls and access from one host to another. Determine whether the account used was a human account, service identity, emergency credential or federated identity.
Endpoints and servers
Examine endpoint detections, process creation, script execution, scheduled tasks, services, startup items, local-account changes, removable media and security-control changes. Correlate the endpoint timeline with network connections and identity events. A suspicious process on one workstation may be a false positive; the same process creating identical outbound connections on several servers changes the scope.
Cloud and operational technology
Include cloud control-plane, storage, identity, workload and SaaS audit records where those systems are relevant. Review administrative actions, API calls, access-key use, policy changes, newly created resources and downloads. For operational technology, involve the control-system owner and safety personnel. Avoid treating production-control equipment like an ordinary workstation: changes can affect physical processes and safety.
Correlate, do not count isolated hits
Build a relationship among accounts, devices, addresses, processes, files, services and times. A single indicator can be reused, spoofed or generated by a legitimate tool. Confidence rises when independent sources agree, such as an identity log showing a successful sign-in, an endpoint record showing a new process and a network record showing the process contacting an unusual destination.
Rank #3
- Students build unmatched deductive-reasoning skills as they become crime-solving stars
- Most scenarios have more than one plausible outcome, allowing individuals or groups to broadly interpret evidence
- Includes interpretive handwriting, body language, fingerprinting, and many more activities
CISA’s federal incident-response playbook describes accurate detection and assessment as determining whether an incident occurred and, if so, the type, extent and magnitude of compromise across cloud, operational-technology, hybrid, host and network systems. Use that breadth as a scope check, while recognizing that the playbook’s reporting obligations are written for federal civilian agencies.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
4. Answer the five scope questions
For every affected account, asset or service, document answers to these questions and update them when new evidence appears:
- What access occurred? Identify authentication, remote shell, application, API, physical, email or other access, and whether it succeeded.
- Which assets were touched? List hosts, identities, applications, cloud resources, databases, network segments and operational systems.
- What privilege was obtained? Distinguish ordinary user, local administrator, domain or directory administrator, cloud administrator, service identity and device-control privilege.
- Was access maintained or expanded? Look for new accounts, keys, tokens, scheduled tasks, services, startup changes, remote tools, altered policies and lateral movement.
- What was the impact? Identify possible data access or alteration, credential exposure, service disruption, safety effect, financial activity and interruption of business operations.
Do not infer data theft solely from a successful login. Establish what the identity could reach and whether records show viewing, querying, exporting, deletion or transfer. Conversely, do not infer that no data was accessed just because outbound transfer was not observed; missing flow logs, encrypted channels and expired retention can leave that question unresolved.
5. Preserve evidence while maintaining continuity
Preserve the logs and artifacts needed to verify, categorize, mitigate, report and investigate the event. Restrict access to collected material, protect it from deletion or alteration, and follow your retention policy. Export original records in their native format when possible, then create working copies for analysis.
Volatile evidence comes first
Memory, active network connections, running processes and temporary files can disappear when a system is rebooted, powered off or automatically cleaned. CISA’s ransomware guidance warns that volatile evidence and short-retention logs may be lost. If endpoint forensic analysis is needed, its playbook advises considering memory and disk imaging.
Recommended Free Tools
Do not casually power off a suspected system. A shutdown may stop an attacker, but it can also destroy memory evidence, trigger encryption, or interrupt a safety-critical process. Use trained responders and the incident plan to balance containment, evidence preservation and business continuity. A forensic write blocker can help prevent changes when imaging certain storage media, but it is specialist equipment and is not a requirement for a routine initial check.
Maintain an evidence and timeline record
For every item, record:
- the source system, account or person who supplied it;
- the collection date, time zone and method;
- the collector and anyone who handled it afterward;
- the original filename, format and any integrity value your process uses;
- where the original and working copy are stored; and
- any filtering, parsing, conversion or other transformation.
Create a timeline with columns for time, source, observed event, affected account or asset, investigative action and resulting finding. Preserve clock information and note clock drift or uncertain time conversions. This practical documentation supports later technical, legal, insurance or law-enforcement review; it is not a substitute for a jurisdiction-specific forensic protocol.
Rank #4
6. Decide whether the event is confirmed
At the assessment point, state a conclusion with boundaries. For example: “Malicious sign-in and unauthorized privilege change are confirmed on the identity platform. No evidence currently establishes database access. Firewall logs for the first six hours were not retained, so earlier activity cannot be excluded.” This is more useful than “we were hacked” or “the scan was clean.”
A clean scan, an absence of known indicators or a stopped alert does not resolve exposure when logging is incomplete, retention has expired, systems were offline or the attacker used an undetected technique. Explain exactly what the evidence can and cannot establish. Revisit the conclusion after credential resets, additional log collection, provider responses or forensic analysis.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →7. Contain and eradicate in a coordinated way
Containment should follow the response plan and be approved by the people who own the affected service. Options may include disabling or resetting credentials, revoking tokens and keys, isolating an endpoint, blocking infrastructure, removing unauthorized accounts, restricting network paths or taking a service offline. Choose the least disruptive action that stops ongoing harm, unless safety or active destruction requires faster isolation.
Preserve evidence before changing a system when doing so will not permit continued harm. Record who authorized each action, its time, expected effect and observed result. Coordinate changes across identity, endpoint, network, cloud and operational teams so that one action does not leave an alternative access path open.
CISA advises considering third-party incident-response support when specialist expertise is needed to eradicate an actor and avoid residual access. Outside support does not transfer accountability: internal owners still control authorization, business decisions, communications and legal coordination.
8. Report through the correct channels
Reporting duties depend on jurisdiction, organization type, sector, data involved, contracts, insurance terms and incident facts. The federal playbook’s agency obligations are not a universal private-sector rule. Have counsel and the responsible compliance team identify the actual deadlines and recipients, including regulators, customers, employees, insurers, contractual partners and sector bodies.
For organizations in the United States, CISA lists an online reporting route and 1-844-Say-CISA. CISA also directs organizations to local FBI field offices and the Internet Crime Complaint Center (IC3). Verify the current contact process before submitting because channels and guidance can change. Preserve the case record and supporting evidence supplied with any report.
9. Choose the right investigation model
Some organizations can investigate internally; others need an external responder or a coordinated combination. Evaluate the approach against the incident, not against a generic provider ranking.
| Decision factor | Questions to ask |
|---|---|
| Coverage and access | Can the team examine the endpoint, identity, network, cloud and operational systems relevant to this event? |
| Evidence handling | Can it preserve logs, image systems when appropriate, document custody and support legal or law-enforcement needs? |
| Speed and availability | Can responders start promptly, including outside normal business hours? |
| Operational fit | Do they understand the organization’s technology, production constraints and safety requirements? |
| Independence and coordination | Are roles clear with internal IT, counsel, the insurer, regulators and law enforcement? |
| Cost and authorization | Are scope, rates, access permissions and approval authority for collection and containment documented? |
Before granting access, define the systems in scope, evidence restrictions, communications path, deliverables, decision authority and how sensitive information will be protected.
Quick Recap
10. Common mistakes that weaken an assessment
- Stopping at the first alert: the initial device or account may be only one part of the intrusion.
- Calling an event benign without verification: legitimate tools and stolen credentials can look similar.
- Rebooting or wiping immediately: this can destroy memory and short-lived artifacts.
- Relying on one log source: independent endpoint, identity and network records provide stronger corroboration.
- Assuming no evidence means no activity: retention gaps and unlogged systems create uncertainty.
- Resetting one password and closing the case: tokens, keys, service accounts, persistence and privilege changes may remain.
- Making public or contractual statements too early: coordinate facts and wording with legal, communications and required recipients.
- Letting an outside responder act without authority boundaries: define who can isolate systems, collect data or contact third parties.
11. A concise investigation checklist
- Open an incident record and assign the incident lead.
- Capture the original alert, time zone, affected identity or asset and actions already taken.
- Check maintenance, testing, administration and automation that could explain the signal.
- Confirm logging coverage, clock accuracy and retention for the relevant period.
- Search perimeter, internal, endpoint, identity, cloud and operational-technology evidence as applicable.
- Correlate accounts, devices, processes, connections, privileges and times.
- Preserve volatile evidence and logs before they expire or systems are changed, when safe.
- Document access type, affected assets, privilege, persistence or lateral movement and impact.
- Assign an evidence-supported status and list unresolved questions.
- Coordinate containment, eradication, continuity and specialist support through the response plan.
- Determine reporting and notification duties with counsel and the responsible compliance owners.
- Update the timeline, preserve the case record and revise scope as findings change.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
