Authorization and scope ☐ Investigation owner and approver recorded ☐ Triggering alert or request recorded ☐ Systems, accounts, tenants, and locations in scope ☐ Start/end time and timezone recorded ☐ Legal, privacy, and handling restrictions reviewed Evidence collection ☐ Source system and export method recorded ☐ Original evidence preserved according to policy ☐ Collection time and collector recorded ☐ Relevant retention limits identified ☐ Integrity or chain-of-custody requirements followed ☐ Known collection gaps documented Analysis ☐ Timeline created using normalized and original timestamps ☐ Identities, assets, sessions, and network context resolved ☐ Observations separated from interpretations ☐ Primary hypothesis and alternatives recorded ☐ Supporting and contradicting evidence listed ☐ Threat intelligence treated as context, not proof ☐ Confidence and uncertainty stated Response and communication ☐ Immediate risk and affected business service assessed ☐ Actions authorized by the correct owner ☐ Containment changes and timestamps recorded ☐ Stakeholders and escalation path identified ☐ Required notifications evaluated by authorized teams Review and closure ☐ Key findings link back to evidence ☐ Limitations and unresolved questions included ☐ Human analyst reviewed AI-assisted outputs ☐ Follow-up actions have owners and due dates ☐ Lessons learned and control gaps recorded ☐ Evidence retained or disposed of according to policy Important: This resource is an operational aid, not legal advice or a replacement for your organization’s incident-response plan. Follow your approved procedures and escalation authority.
Use it with an evidence-grounded workflow The checklist is most useful when every important claim remains connected to its source. Review the security log analysis guide or explore how SecureViewIQ supports analyst-reviewed investigations .