Initial Incident Intake Scoping

Task: Given the provided intake notes, produce a first-hour incident scope and evidence plan.

Rules:

• If details are missing, ask targeted questions.
• Don’t assume logging sources exist—confirm.
• Use the reporter’s time zone; if unknown, call it out.

Provided intake notes: {{intake_notes}}

Environment summary (if any): {{environment_summary}}

Deliverables:

1. Incident summary (2–5 sentences)
2. Working hypothesis (what you think is happening + confidence)
3. Time window (earliest suspected activity → latest)
4. Known / Unknown (bullets)
5. Immediate containment considerations (safe, low-regret actions)
6. Evidence / logs to request next (prioritized, with WHY for each)
7. Next 60 minutes plan (checklist)

Suggested intake questions

• What triggered the report (alert type, user report, anomaly)?
• What’s the impacted business function (email, HR, finance, prod)?
• Which identities/assets are suspected (usernames, hostnames, IPs)?
• Any recent “change events” (password reset, MFA changes, new admin roles)?
• What actions already taken (reimage, isolate, disable account)?

Evidence request starter list

Pick the relevant items based on incident type:

• Identity (Entra/AD/Okta): sign-in logs, audit logs, MFA events, risky sign-ins
• Email: message trace, headers, URL click logs, mailbox audit, rules/forwarding
• Endpoints: EDR detections, timeline, process tree, network connections
• Network: proxy/DNS logs, firewall flows, VPN logs
• Cloud: CloudTrail / GCP audit logs / Azure activity, object storage access logs