Module
Investigation Methodology
Take an alert that triage marked as worth more time and work it to a handover: written questions, a timeline in one clock, related activity found and bounded, and one page someone accountable can act on.
63 min · Beginner
Start Investigation Methodology
What you will learn
- Turn a triage note into investigation questions that each name their evidence and their decision
- Merge sources into one timeline in UTC, ordered by event time, with gaps marked
- Pivot only where an open question needs it, with a window and a stop rule
- Scope a case across accounts, data, money and exposure, using searches whose limits you know
- Hand over one page on time, with severity set and legal clocks flagged
Lessons
From Alert to Questions
Investigating does not mean looking at everything. Five questions, each with its evidence and the decision it changes.
Build the Timeline
Four sources, four clocks. One timeline in UTC, ordered by when things happened, with the gap left as a gap.
Pivot Without Drowning
Every fact opens onto more facts. Pivot only where a question needs it, and write down what you drop.
Scope It
The first account is contained. A second one is not. Scope across accounts, data, money and exposure.
Hand It Over
Declare the incident, set the severity, write one page and flag the clocks, before you know everything.