What should I record during my first assessment?¶
The first assessment may later become the foundation of the incident timeline.
Avoid the dangerous assumption¶
The dangerous assumption is that technical systems will preserve everything needed and that early notes can be reconstructed later.
Record what prompted the assessment.
Identify who reported the issue, when they reported it and what they directly observed. Separate their observations from conclusions such as “we were hacked” or “data was stolen”.
Record the material received, including filenames, screenshots, alerts, emails, incident references and the systems that produced them.
Document:
- the affected organisation or individual
- the known systems, accounts and devices
- the first known event
- the first detection or report
- whether activity appears ongoing
- the suspected impact
- the people and providers controlling relevant systems
- known retention limits
- preservation actions requested or completed
- containment actions already taken
- changes made before your involvement
- specialists consulted
- outstanding uncertainties.
Use exact timestamps and record the time zone. If a time is approximate, say so. Keep event time, report time, detection time and action time separate.
Record who supplied each technical explanation. Do not convert an analyst’s provisional view into an established fact.
Also document what is not known. Examples include whether a file executed, whether a login was authorised, whether data left the environment or who controlled an account.
Early decision-making should be visible. Record why a particular system was preserved, why another was not, why containment occurred immediately or why specialist assistance was sought.
Good first-assessment notes do more than preserve memory. They allow later reviewers to understand what information was available at each decision point.
Operational takeaway¶
Create a contemporaneous record of the source material, known facts, uncertainties, preservation actions, system changes and reasons for early decisions.