Identity and access, endpoints and servers, network security, data and email, detection and response. For each area involved, you give its technical data, the problems observed and the tests that failed or passed, then rank the problems by urgency. The deliverable correlates the evidence, weighs each probable cause against your tests (a failed test supports it, a passed test rules it out) and, starting with your most urgent problem, gives the investigation path, the root cause analysis, the best correction now and the corrective action to decide.
Contents
1. Evidence Correlation
2. Problem Prioritization
3. Root Cause Hypotheses
4. Optimal Investigation Path
5. Problem-by-Problem Resolution
6. Missing Diagnostic Information
What you provide
Relevant areas — The areas concerned by the incident.
Accounts & Credentials — Accounts concerned, privileged account involved, MFA enabled, then the problems seen and the tests run.
Privileged Access — Systems concerned, privilege changes observed, PAM tool in place, then the problems seen and the tests run.
5 options — A component not listed above: its name, role, vendor and configuration, then the problems seen and the tests run.
