Skip to main content
Cyber incidents and offender methods

A cyber incident may be relevant to my investigation

Establish what is known, whether the activity is continuing and which systems, accounts and services may hold evidence. Containment protects operations but can also alter the record, so preserve and document deliberately.

Investigate now

Start with what needs doing now

Use this route to assess an active incident, preserve the most useful records and make bounded response decisions without assuming specialist support will arrive before evidence changes.

Start the investigationWork through a cyber incident

Move from the initial report to scope, preservation, event sequence, affected systems and careful attribution.

Reference CIM-000Assess urgencyIs the incident still happening?

Distinguish continuing access, automated activity and completed events before deciding what must happen now.

Reference CIM-006Preserve firstWhat should be preserved immediately?

Prioritise volatile logs, sessions, alerts, affected systems and provider records before response activity changes them.

Reference CIM-010
Learn

Understand the evidence and the offender method

Use this route to understand what makes an event a cyber incident and see a separate insider operation create account, transfer and device evidence.

Foundation explanationWhat is a cyber incident?

Separate suspicious activity, security alerts, confirmed events, impact and the evidential questions that follow.

Reference CIM-001Separate offender exampleDodgy Dave downloads the customer list and calls it working from home

See legitimate notice-period access used for insider data theft, leaving account, transfer and device records.

Reference CIM-290
Common questions

Go directly to the issue you need to resolve

Evidence locationsWhich systems, accounts and providers may hold evidence?

Map the incident across source systems before records are overwritten.

Reference CIM-009InterpretationDoes an indicator prove compromise?

Use the match as a line of enquiry and test how it was generated.

Reference CIM-019TimelineHow should the incident sequence be built?

Correlate sources while preserving their different clocks and meanings.

Reference CIM-280Containment recordWhat if the response changes the evidence?

Record who acted, why, when, on what system and with what result.

Reference CIM-286
Browse every Cyber incidents and offender methods guidance page The complete reference library remains available when you need a narrower question.