The case record, and closing it honestly

What a case has to hold before it can close, and why the closing line is the valuable part.

By the end you can

List what a case record must contain.
Say why scope is decided before containment.
Write a closing summary that is useful a year later.

What a case must hold

A case is a record another person can act on without asking you anything.

Which machines and accounts were involved, and which were checked and cleared.
The first evidence of the intruder, with its timestamp and source.
What was done, by whom, and at what time.
What is still unknown, stated plainly.
The closing decision and its reason.

Scope before containment

Pulling the first infected machine off the network feels decisive and often just tells the intruder they have been seen. Find the spread first — the other accounts, the other hosts, the way out — then cut everything at once.

The exception is the one that will not wait: active encryption, or a process being driven towards harm. Then you stop it and scope afterwards.

Check yourself

When is it right to contain before the scope is understood?

What makes a closing summary useful a year later?

Open the case console