Short answer: A strong investigation step names the question, the evidence to inspect, the time or scope boundary, the owner, and the decision that depends on the result. This turns investigation from an open-ended activity into a sequence of testable questions.
Start with a question, not a tool
“Check the logs” is not an investigation plan. It does not say which logs, what time range, which entities, or what the team is trying to learn.
Start with a question such as:
- Was the affected account used successfully after the password reset?
- Did the suspicious process run on other endpoints?
- Did the exposed API key access customer data?
- Was the alert caused by a real control failure or a detection error?
The question determines the evidence and the stopping condition.
Give each step a bounded scope
An investigation step should define the smallest useful scope. Include the entities, time range, data sources, and known limitations.
For example:
Review identity-provider sign-ins for the affected account and its two delegated administrators from 08:00 to 12:00 UTC. Identify successful sessions from new locations and attach the provider event IDs. Escalate if a session appears after revocation.
This is more useful than “look for more suspicious sign-ins” because another responder can repeat or review it.
Separate observation, hypothesis, and decision
Do not treat a hypothesis as a fact. A practical investigation record can use three fields:
- Observation: the alert shows a successful sign-in from a new location.
- Hypothesis: the account may have been accessed using a stolen session or credential.
- Test and decision: compare authentication, endpoint, and application logs. Escalate scope if the same session or token appears elsewhere.
This structure makes it easier to change direction without rewriting the original facts.
Use stop conditions and escalation points
Investigation can expand forever unless the team defines what is enough for the current decision. A step may stop when:
- the agreed data sources have been searched for the full window
- the question has a supported yes or no answer
- the evidence is unavailable and the limitation is recorded
- a higher-impact condition requires escalation
- another action has higher risk reduction value
If the search finds new scope, open a new step with its own owner and completion test. Do not make the original task silently grow until no one knows whether it is complete.
Example investigation sequence
For a suspected mailbox takeover, a lean sequence might be:
| Step | Question | Evidence |
|---|---|---|
| 1 | Which account and mailbox events triggered the alert? | Alert and audit event IDs |
| 2 | Did the account authenticate from an unusual source? | Identity logs |
| 3 | Were forwarding rules, delegates, or tokens changed? | Mail and identity audit logs |
| 4 | Did the account access sensitive messages or files? | Application access records |
| 5 | Are there signs of the same pattern in related accounts? | Scoped search results |
Each result should update scope, containment, communication, or recovery decisions.
Preserve the evidence path
Record the source, query or method, collection time, timezone, and any transformation applied to the result. If the original source is not retained in the incident system, record where it lives and who can access it.
NIST describes incident response as part of broader cybersecurity risk management, and its forensic guidance emphasises integrating evidence handling with response activities. The practical implication is simple: an investigation note should let a reviewer understand how the conclusion was reached.
IncidentAI can help structure investigation notes, related evidence, timelines, and draft summaries. It cannot establish facts that the available sources do not support or replace an analyst’s judgement about scope and significance.
FAQ
How many investigation steps should an incident have?
There is no useful fixed number. Use the fewest bounded steps needed to answer the current questions, then add a new step when evidence changes the scope or decision.
Should investigation steps be written before containment?
Some initial investigation can happen before or during containment, but do not delay urgent risk reduction while seeking perfect information. Record the tradeoff and return to the unanswered questions after containment.
Sources and further reading
- NIST SP 800-61 Rev. 3
- NIST SP 800-86: Guide to Integrating Forensic Techniques into Incident Response