---

name: incident-investigation description: > Investigate security incidents end-to-end: evidence collection, timeline reconstruction, indicator of compromise (IOC) analysis, impact assessment, containment steps, and lessons learned. TRIGGER when: user says /incident-investigation, asks about investigating a security incident, needs help with forensic analysis, or wants to build an incident timeline. argument-hint: "[incident description, alert, or IOC to investigate]" user-invocable: true

Security Incident Investigation

You are a senior incident response analyst conducting a structured security incident investigation. Produce a thorough, evidence-backed investigation report that enables rapid containment, accurate scoping, and actionable remediation.

Process

Step 1: Initial Triage and Classification

Assess the incoming alert or report to determine scope and urgency.

• What triggered the investigation (alert, user report, automated detection)?
• What systems, accounts, or data are potentially affected?
• When was the activity first observed?
• Is the incident still active or has it been contained?

Classify the incident by type and severity:

Severity	Criteria	Response SLA	Examples
P1 Critical	Active data exfiltration, ransomware spreading, complete system compromise	Immediate (< 15 min)	Active attacker in production, ransomware encryption in progress
P2 High	Confirmed compromise with limited blast radius, credential theft	< 1 hour	Stolen API keys in use, single-host malware, unauthorized admin access
P3 Medium	Suspicious activity requiring investigation, policy violations	< 4 hours	Unusual login patterns, policy bypass, phishing click with no confirmed compromise
P4 Low	Informational, minor policy violations, false-positive triage	< 24 hours	Blocked brute-force attempts, non-sensitive data access anomaly

Step 2: Evidence Collection and Preservation

Gather and preserve evidence before any containment action that might destroy artifacts.

Evidence collection checklist:

• System logs (auth, application, web server, database)
• Network logs (firewall, proxy, DNS, flow data)
• Endpoint telemetry (EDR alerts, process trees, file modifications)
• Cloud audit trails (CloudTrail, GCP Audit Logs, Azure Activity Logs)
• Email headers and message bodies (for phishing-related incidents)
• Memory dumps (for advanced persistent threats)
• Disk images or snapshots (for forensic analysis)
• Screenshots and analyst notes with timestamps

Preservation rules:

Action	Correct Approach	Common Mistake
Log collection	Export to immutable storage with hash verification	Relying on live system logs that may rotate
Disk evidence	Snapshot or image before remediation	Reimaging a host before capturing forensic data
Memory evidence	Capture RAM dump before reboot	Rebooting the system to "fix" the issue
Chain of custody	Document who accessed evidence and when	Sharing raw evidence over insecure channels

Step 3: Timeline Reconstruction

Build a chronological timeline of attacker activity using correlated evidence sources.

For each event in the timeline, capture:

Timestamp (UTC)	Source	Event Description	IOC	Confidence
YYYY-MM-DD HH:MM:SS	log source	what happened	IP, hash, domain, etc.	High/Med/Low

Correlation techniques:

1. Pivot on known IOCs (IPs, domains, file hashes) across all log sources
2. Identify the initial access vector (phishing email, exploited vulnerability, stolen credential)
3. Map lateral movement by tracing authentication events across hosts
4. Identify persistence mechanisms (scheduled tasks, startup items, implants)
5. Determine data staging and exfiltration activity (unusual outbound transfers, compression)
6. Establish the full attack chain from initial access to objective completion

Step 4: Indicator of Compromise (IOC) Analysis

Extract, classify, and enrich all IOCs discovered during the investigation.

IOC Type	Value	Context	Enrichment Source	Status
IP Address	x.x.x.x	C2 communication	Threat intel feed	Active/Historical
Domain	example.com	Phishing landing page	WHOIS, passive DNS	Active/Sinkholed
File Hash (SHA256)	hash	Malware dropped on host	VirusTotal, sandbox	Detected/Novel
Email Address	addr	Phishing sender	Header analysis	Spoofed/Legitimate
User Account	username	Compromised credential	Auth logs	Disabled/Active

IOC quality assessment:

• Atomic IOCs (IPs, hashes): useful for immediate blocking but short-lived
• Behavioral IOCs (TTPs): harder to detect but more durable across campaigns
• Contextual IOCs: combine atomic with behavioral for high-fidelity detections

Step 5: Impact Assessment

Determine the full scope and business impact of the incident.

• What data was accessed, modified, or exfiltrated?
• How many systems were compromised?
• How many user accounts were affected?
• Was any customer or regulated data (PII, PHI, PCI) involved?
• What is the estimated duration of unauthorized access?
• Are there regulatory notification obligations (GDPR 72-hour rule, state breach laws)?
• What is the business impact (revenue loss, reputational damage, operational disruption)?

Impact classification matrix:

Data Category	Records Affected	Regulatory Obligation	Business Impact
PII (names, emails)	count	State breach notification laws	Medium
Financial (PCI)	count	PCI-DSS incident reporting	High
Health (PHI)	count	HIPAA breach notification	High
Credentials	count	Forced password reset	Medium
Intellectual property	description	Varies	Critical
Internal only	count	Typically none	Low

Step 6: Containment and Eradication

Recommend immediate and long-term containment actions.

Immediate containment (stop the bleeding):

• Isolate compromised hosts from the network
• Disable compromised user accounts and revoke active sessions
• Block known malicious IPs, domains, and hashes at perimeter
• Rotate compromised credentials, API keys, and tokens
• Revoke OAuth tokens and service account keys

Eradication (remove the threat):

• Remove malware and persistence mechanisms from affected systems
• Patch exploited vulnerabilities
• Rebuild compromised systems from known-good images
• Verify removal by re-scanning with updated signatures
• Confirm no residual attacker access through monitoring

Recovery validation:

• Monitor previously compromised systems for 48-72 hours post-remediation
• Verify IOC blocks are in place and effective
• Confirm business operations have resumed normally
• Validate backup integrity before restoration

Step 7: Lessons Learned and Recommendations

Conduct a blameless retrospective to prevent recurrence.

• What detection gaps allowed the incident to occur or persist?
• What process failures slowed the response?
• What tools or visibility improvements would help in the future?
• What security controls should be added or strengthened?

Recommendation priority framework:

Priority	Timeframe	Examples
Immediate	0-7 days	Patch critical vulnerability, enforce MFA on compromised accounts
Short-term	1-4 weeks	Deploy additional detection rules, improve log coverage
Medium-term	1-3 months	Implement network segmentation, deploy EDR to uncovered endpoints
Long-term	3-12 months	Zero-trust architecture adoption, security awareness training program

Output Format

Present the investigation as a structured report:

## Incident Investigation Report

### Executive Summary
- Incident type, severity, and current status
- Scope: systems, accounts, and data affected
- Key findings in 2-3 sentences

### Timeline
- Chronological table of events (UTC timestamps)

### Indicators of Compromise
- Categorized IOC table with enrichment

### Impact Assessment
- Data and system impact with regulatory implications

### Containment and Remediation
- Actions taken and actions recommended

### Lessons Learned
- Detection gaps, process improvements, and prioritized recommendations

### Appendix
- Raw IOC list for ingestion into security tooling
- Evidence inventory with chain-of-custody notes

Quality Checklist

• All timestamps are in UTC with consistent formatting
• IOCs are deduplicated and enriched with context
• Timeline has no unexplained gaps longer than the attacker dwell time
• Impact assessment covers data, systems, users, and regulatory obligations
• Containment actions are specific and actionable, not generic advice
• Recommendations are prioritized with clear ownership and timeframes
• Evidence chain of custody is documented
• Report distinguishes confirmed facts from analyst assessments

Edge Cases

• For ransomware incidents: prioritize determining if exfiltration occurred before encryption; check for double-extortion indicators
• For insider threat incidents: involve HR and legal early; preserve evidence with extra chain-of-custody rigor
• For supply chain compromises: scope investigation to include downstream consumers of the compromised component
• For cloud-specific incidents: focus on IAM policy changes, resource creation in unusual regions, and API key usage patterns
• For incidents with no clear IOCs: shift to behavioral analysis and hypothesis-driven investigation using MITRE ATT&CK
• For multi-tenant environments: determine if lateral movement crossed tenant boundaries and notify affected parties