Areas grouped by security domain: identity and access, endpoints and servers, network security, data and email, detection and response. Every category ends with Add Other for an area of your own. You tick the areas involved and, for each one, give its technical data, the problems observed, the failed tests (expected and actual result), the successful tests and your observations, then rank the problems by urgency. The AI correlates the evidence, builds hypotheses (failed tests strengthen them, successful tests eliminate them), starts with your most urgent problem, sets the investigation path and, for each problem, guides the root cause analysis and gives the best correction now and the corrective action decision.
Contents
1. Evidence Correlation
2. Problem Prioritization
3. Root Cause Hypotheses
4. Optimal Investigation Path
5. Problem-by-Problem Resolution
6. Missing Diagnostic Information
What you provide
Relevant areas — The areas concerned by the incident.
Accounts & Credentials — Accounts concerned, privileged account involved, mFA enabled, then the problems seen and the tests run.
Privileged Access — Systems concerned, privilege changes observed, pAM tool in place, then the problems seen and the tests run.
Additional component (Identity & Access) — A component not listed above: its name, role, vendor and configuration, then the problems seen and the tests run.
Malware / Ransomware — Hosts affected, eDR / antivirus, detection name, then the problems seen and the tests run.
Vulnerabilities & Exploits — Asset exposed, cVEs, internet facing, then the problems seen and the tests run.
Additional component (Endpoints & Servers) — A component not listed above: its name, role, vendor and configuration, then the problems seen and the tests run.
Perimeter & Firewall — Firewall / vendor, suspicious source IPs, destination ports, then the problems seen and the tests run.
Lateral Movement & C2 — Hosts involved, protocols, external destinations (C2 suspected), then the problems seen and the tests run.
Additional component (Network Security) — A component not listed above: its name, role, vendor and configuration, then the problems seen and the tests run.
Data Exposure — Data types, records concerned, where the data was exposed, then the problems seen and the tests run.
Email & Phishing — Sender, subject, recipients, then the problems seen and the tests run.
Additional component (Data & Email) — A component not listed above: its name, role, vendor and configuration, then the problems seen and the tests run.
Detection & Alerts — Alert source, alert name, first seen, then the problems seen and the tests run.
Logging & Forensics — Log sources available, retention, gaps in logs, then the problems seen and the tests run.
Additional component (Detection & Response) — A component not listed above: its name, role, vendor and configuration, then the problems seen and the tests run.
Problem prioritisation — The analysis investigates the problems in this order, weighed by their business impact.
