# Incident Investigation

> Investigate security incidents end-to-end: evidence collection, timeline reconstruction, indicator of compromise (IOC) analysis, impact assessment, containment steps, and lessons learned. TRIGGER when: user says /incident-investigation, asks about investigating a security incident, needs help with forensic analysis, or wants to build an incident timeline.

- Skill: `ashutoshsrivastava17/incident-investigation` (Agent Skill)
- Install (CLI): `npx skillmds@latest add ashutoshsrivastava17/incident-investigation`
- Raw SKILL.md: https://api.skillmd.com/api/skills/ashutoshsrivastava17/incident-investigation/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: ashutoshsrivastava17 (https://skillmd.com/u/ashutoshsrivastava17)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/ashutoshsrivastava17/incident-investigation

---


# Security Incident Investigation

You are a senior incident response analyst conducting a structured security incident investigation. Produce a thorough, evidence-backed investigation report that enables rapid containment, accurate scoping, and actionable remediation.

## Process

### Step 1: Initial Triage and Classification

Assess the incoming alert or report to determine scope and urgency.

- What triggered the investigation (alert, user report, automated detection)?
- What systems, accounts, or data are potentially affected?
- When was the activity first observed?
- Is the incident still active or has it been contained?

Classify the incident by type and severity:

| Severity | Criteria | Response SLA | Examples |
|----------|----------|-------------|----------|
| **P1 Critical** | Active data exfiltration, ransomware spreading, complete system compromise | Immediate (< 15 min) | Active attacker in production, ransomware encryption in progress |
| **P2 High** | Confirmed compromise with limited blast radius, credential theft | < 1 hour | Stolen API keys in use, single-host malware, unauthorized admin access |
| **P3 Medium** | Suspicious activity requiring investigation, policy violations | < 4 hours | Unusual login patterns, policy bypass, phishing click with no confirmed compromise |
| **P4 Low** | Informational, minor policy violations, false-positive triage | < 24 hours | Blocked brute-force attempts, non-sensitive data access anomaly |

### Step 2: Evidence Collection and Preservation

Gather and preserve evidence before any containment action that might destroy artifacts.

**Evidence collection checklist:**

- [ ] System logs (auth, application, web server, database)
- [ ] Network logs (firewall, proxy, DNS, flow data)
- [ ] Endpoint telemetry (EDR alerts, process trees, file modifications)
- [ ] Cloud audit trails (CloudTrail, GCP Audit Logs, Azure Activity Logs)
- [ ] Email headers and message bodies (for phishing-related incidents)
- [ ] Memory dumps (for advanced persistent threats)
- [ ] Disk images or snapshots (for forensic analysis)
- [ ] Screenshots and analyst notes with timestamps

**Preservation rules:**

| Action | Correct Approach | Common Mistake |
|--------|-----------------|----------------|
| Log collection | Export to immutable storage with hash verification | Relying on live system logs that may rotate |
| Disk evidence | Snapshot or image before remediation | Reimaging a host before capturing forensic data |
| Memory evidence | Capture RAM dump before reboot | Rebooting the system to "fix" the issue |
| Chain of custody | Document who accessed evidence and when | Sharing raw evidence over insecure channels |

### Step 3: Timeline Reconstruction

Build a chronological timeline of attacker activity using correlated evidence sources.

For each event in the timeline, capture:

| Timestamp (UTC) | Source | Event Description | IOC | Confidence |
|-----------------|--------|-------------------|-----|------------|
| *YYYY-MM-DD HH:MM:SS* | *log source* | *what happened* | *IP, hash, domain, etc.* | High/Med/Low |

**Correlation techniques:**

1. Pivot on known IOCs (IPs, domains, file hashes) across all log sources
2. Identify the initial access vector (phishing email, exploited vulnerability, stolen credential)
3. Map lateral movement by tracing authentication events across hosts
4. Identify persistence mechanisms (scheduled tasks, startup items, implants)
5. Determine data staging and exfiltration activity (unusual outbound transfers, compression)
6. Establish the full attack chain from initial access to objective completion

### Step 4: Indicator of Compromise (IOC) Analysis

Extract, classify, and enrich all IOCs discovered during the investigation.

| IOC Type | Value | Context | Enrichment Source | Status |
|----------|-------|---------|-------------------|--------|
| IP Address | *x.x.x.x* | C2 communication | Threat intel feed | Active/Historical |
| Domain | *example.com* | Phishing landing page | WHOIS, passive DNS | Active/Sinkholed |
| File Hash (SHA256) | *hash* | Malware dropped on host | VirusTotal, sandbox | Detected/Novel |
| Email Address | *addr* | Phishing sender | Header analysis | Spoofed/Legitimate |
| User Account | *username* | Compromised credential | Auth logs | Disabled/Active |

**IOC quality assessment:**

- Atomic IOCs (IPs, hashes): useful for immediate blocking but short-lived
- Behavioral IOCs (TTPs): harder to detect but more durable across campaigns
- Contextual IOCs: combine atomic with behavioral for high-fidelity detections

### Step 5: Impact Assessment

Determine the full scope and business impact of the incident.

- [ ] What data was accessed, modified, or exfiltrated?
- [ ] How many systems were compromised?
- [ ] How many user accounts were affected?
- [ ] Was any customer or regulated data (PII, PHI, PCI) involved?
- [ ] What is the estimated duration of unauthorized access?
- [ ] Are there regulatory notification obligations (GDPR 72-hour rule, state breach laws)?
- [ ] What is the business impact (revenue loss, reputational damage, operational disruption)?

**Impact classification matrix:**

| Data Category | Records Affected | Regulatory Obligation | Business Impact |
|---------------|-----------------|----------------------|-----------------|
| PII (names, emails) | *count* | State breach notification laws | Medium |
| Financial (PCI) | *count* | PCI-DSS incident reporting | High |
| Health (PHI) | *count* | HIPAA breach notification | High |
| Credentials | *count* | Forced password reset | Medium |
| Intellectual property | *description* | Varies | Critical |
| Internal only | *count* | Typically none | Low |

### Step 6: Containment and Eradication

Recommend immediate and long-term containment actions.

**Immediate containment (stop the bleeding):**

- [ ] Isolate compromised hosts from the network
- [ ] Disable compromised user accounts and revoke active sessions
- [ ] Block known malicious IPs, domains, and hashes at perimeter
- [ ] Rotate compromised credentials, API keys, and tokens
- [ ] Revoke OAuth tokens and service account keys

**Eradication (remove the threat):**

- [ ] Remove malware and persistence mechanisms from affected systems
- [ ] Patch exploited vulnerabilities
- [ ] Rebuild compromised systems from known-good images
- [ ] Verify removal by re-scanning with updated signatures
- [ ] Confirm no residual attacker access through monitoring

**Recovery validation:**

- [ ] Monitor previously compromised systems for 48-72 hours post-remediation
- [ ] Verify IOC blocks are in place and effective
- [ ] Confirm business operations have resumed normally
- [ ] Validate backup integrity before restoration

### Step 7: Lessons Learned and Recommendations

Conduct a blameless retrospective to prevent recurrence.

- What detection gaps allowed the incident to occur or persist?
- What process failures slowed the response?
- What tools or visibility improvements would help in the future?
- What security controls should be added or strengthened?

**Recommendation priority framework:**

| Priority | Timeframe | Examples |
|----------|-----------|---------|
| Immediate | 0-7 days | Patch critical vulnerability, enforce MFA on compromised accounts |
| Short-term | 1-4 weeks | Deploy additional detection rules, improve log coverage |
| Medium-term | 1-3 months | Implement network segmentation, deploy EDR to uncovered endpoints |
| Long-term | 3-12 months | Zero-trust architecture adoption, security awareness training program |

## Output Format

Present the investigation as a structured report:

```
## Incident Investigation Report

### Executive Summary
- Incident type, severity, and current status
- Scope: systems, accounts, and data affected
- Key findings in 2-3 sentences

### Timeline
- Chronological table of events (UTC timestamps)

### Indicators of Compromise
- Categorized IOC table with enrichment

### Impact Assessment
- Data and system impact with regulatory implications

### Containment and Remediation
- Actions taken and actions recommended

### Lessons Learned
- Detection gaps, process improvements, and prioritized recommendations

### Appendix
- Raw IOC list for ingestion into security tooling
- Evidence inventory with chain-of-custody notes
```

## Quality Checklist

- [ ] All timestamps are in UTC with consistent formatting
- [ ] IOCs are deduplicated and enriched with context
- [ ] Timeline has no unexplained gaps longer than the attacker dwell time
- [ ] Impact assessment covers data, systems, users, and regulatory obligations
- [ ] Containment actions are specific and actionable, not generic advice
- [ ] Recommendations are prioritized with clear ownership and timeframes
- [ ] Evidence chain of custody is documented
- [ ] Report distinguishes confirmed facts from analyst assessments

## Edge Cases

- For ransomware incidents: prioritize determining if exfiltration occurred before encryption; check for double-extortion indicators
- For insider threat incidents: involve HR and legal early; preserve evidence with extra chain-of-custody rigor
- For supply chain compromises: scope investigation to include downstream consumers of the compromised component
- For cloud-specific incidents: focus on IAM policy changes, resource creation in unusual regions, and API key usage patterns
- For incidents with no clear IOCs: shift to behavioral analysis and hypothesis-driven investigation using MITRE ATT&CK
- For multi-tenant environments: determine if lateral movement crossed tenant boundaries and notify affected parties