Is the incident still happening?¶

One of the first operational questions is whether the activity is continuing.

Evidential caution: that discovery marks the end of the incident. An organisation may only have discovered activity that began earlier and remains active through an account, remote session, malicious process, scheduled task, token or compromised service.

What this means¶

Are suspicious sessions still active?

Are new alerts continuing?

Is data still being transferred?

Are accounts still authenticating from unexpected locations or devices?

Are malicious processes, remote-access tools or command channels still running?

Are users still being redirected, locked out or impersonated?

Has the organisation contained the activity, or only noticed it?

Current activity changes the balance between preservation and containment. Leaving an attacker connected may expose more victims or data. Terminating the connection may destroy volatile evidence or alert the offender. That decision may require incident-response, legal and investigative input.

Where immediate harm is possible, protecting people, services and data may take priority over preserving every technical artefact. The decision and its rationale should be recorded.

================================================================================

What to check or do next¶

• Look for current indicators.
• Record the last confirmed event, the last alert, the last known session and the time of any containment action. Keep event time, detection time and response time separate.

Evidential limits¶

Do not assume that silence means the activity has stopped. Security tools may have lost visibility, the offender may have changed method or the activity may be intermittent.

The investigator does not need to direct technical containment personally. The role is to ensure that evidential consequences are considered and that actions taken are documented.