How to Check Whether Your Organization Was Affected by a Suspected Cyber Intrusion

Start with the alert, but do not treat it as proof of compromise. A defensible determination comes from correlating evidence across perimeter devices, internal networks, endpoints, identity systems, cloud services and, where relevant, operational technology. You need to establish what happened, when it happened, which accounts and assets were involved, what access was obtained, whether the intruder persisted or moved laterally, and what information or operations were affected.

Activate your incident-response process immediately, preserve logs and volatile evidence before they disappear, and keep a written timeline. Classify the event as an unconfirmed alert, verified malicious activity or confirmed impact only when the available evidence supports that label. A clean scan or an absence of alerts is not proof that nothing happened if logging was incomplete or retention has expired.

#	Preview	Product	Price
1		Tableau Comprehensive Write Block Kit with SiForce Rugged Case (T8u, T7u, T6u, T35u, Tableau...	$2,599.99	Buy on Amazon
2		The Forensic Certified Public Accountant and the Halloween Identity Theft Ghost Employee (The...	$9.87	Buy on Amazon
3		Mark Twain Forensic Investigations Workbook, Using Science to Solve High Crimes Middle School Books,...	$13.04	Buy on Amazon
4		Test Results for Hardware Write Block Device: T4 Forensic SCSI Bridge (FireWire Interface) July 2009	$15.99	Buy on Amazon

As an Amazon Associate I earn from qualifying purchases.

What an intrusion alert does—and does not—tell you

An alert is a lead for investigation. It may be generated by an endpoint tool, firewall, identity service, cloud control, employee report, customer notification or law-enforcement contact. The signal can be accurate, incomplete, duplicated or caused by authorized administration. CISA describes accurate detection and assessment as one of the hardest parts of incident response because investigators must determine whether an incident occurred and, if so, its type, extent and magnitude across cloud, operational-technology, hybrid, host and network systems.

Begin by recording the alert exactly as received. Preserve the original message, alert identifier, timestamps, source system, account or device named, network addresses, file or process names, and any analyst notes. Do not edit the original record while trying to make it easier to read; make a separate working copy.

#1 Best Overall

Tableau Comprehensive Write Block Kit with SiForce Rugged Case (T8u, T7u, T6u, T35u, Tableau Adapters, USB Media Card Reader, Rugged Case)

• This comprehensive forensic imaging kit includes four different Tableau write-block bridges, a variety of adapters to support most common device interfaces, and durable SiForce Rugged Case.
• Tableau write-block bridges included: T8u (USB 3.0), T7u (PCIe), T35u (SATA/IDE), and T6u (SAS).
• PCIe Adapters (Compatible with T7u) Include: TDA7-1 PCIe Card SSD Adapter, TDA7-2 M.2 PCIe SSD Adapter, TDA7-3 Apple SSD 2013-2016 Adapter, TDA7-4 U.2 PCIE SSD Adapter, TDA7-7 Apple SSD 2016+ Adapter, PCIE-4 Tableau Pigtail Cable.
• Other Adapters/Components Include: Tableau TDA3-3 mSATA/m.2 SATA SSD Adapter (Compatible with T35u), SiForce USB Media Card Reader (Compatible with T8u), TC3-8 SATA Signal Cable, TC4-8-R2 Unified SAS Cable, TC5-8-2 SATA to 2M Drive Power Cable, TC6-8 IDE Cable, TC2-8-R2 Molex Drive Power Cable, TC-USB3 USB 3.0 A to B Cable (x2), TP2 Tableau Power Supply with A/C Power Cord (x2), and SiForce Rugged Case.
• Kit List: T8u, T7u, T35u, T6u, TKDA-PCIE-5PC (TDA7-1, TDA7-2, TDA7-3, TDA7-4, TDA7-7, PCIE-4), TC3-8, TC4-8-R2, TC5-8-R2, TC6-8, TC2-8-R2, TP2 + AC power cord (x2), TC-USB3 (x2),TDA3-3, SiForce USB Media Card Reader, and SiForce Rugged Case.

$2,599.99

Buy on Amazon

Then ask whether a planned change, vulnerability scan, penetration test, remote-support session, service-account job or other authorized action explains the activity. Deconflicting legitimate work prevents an expensive investigation from being built around a false positive. It does not justify dismissing unusual behavior without checking with the person or team responsible for the change.

1. Activate the response process

Use the incident-response plan rather than improvising individual actions. Notify the designated incident lead and the contacts assigned to technology, security, leadership, legal, communications and business continuity. If the plan specifies an incident bridge, secure chat room or case-management system, open it and restrict access to people who need the information.

Create an initial incident record

At minimum, capture:

• the date and time the organization received the report, including the time zone;
• the person or system that generated it;
• the affected business service, account, device, application or site;
• the indicators supplied with the report;
• known maintenance or authorized activity that might explain them;
• actions already taken, such as disabling an account or isolating a host; and
• the person responsible for each next action.

CISA recommends establishing logging and monitoring practices and assigning a crisis-response team with defined roles. Your record should therefore show who can approve collection, containment, communications and external reporting. If the organization has cyber insurance, note the insurer’s notification route and any requirement to use an approved response firm before retaining outside help.

Protect the investigation channel

Assume that ordinary email or a compromised collaboration account may be visible to an intruder. Use the out-of-band method specified in your plan for sensitive coordination, and apply the organization’s access controls and retention rules. Do not circulate unverified accusations or personal data to a broad mailing list; investigation notes often contain credentials, employee information or customer details.

2. Validate and triage the signal

Validation means determining what the alert actually represents, not trying to prove innocence from a single clean result. Work from the original source and expand outward.

Answer the basic questions first

1. What generated the alert? Identify the product, service, sensor, employee or third party and the detection rule or observation involved.
2. When did the activity occur? Record the event time and the time it was detected. Check the time zone and whether the source clock is synchronized.
3. Which identity or asset was involved? Resolve host names, device identifiers, user accounts, service accounts, cloud tenants and network addresses to owners and business functions.
4. What exactly was observed? Preserve the event fields, process or command names, destination, authentication result, file path, data transfer and response code when available.
5. Could authorized activity explain it? Check change tickets, maintenance windows, vulnerability scans, administrator actions, automated jobs and approved testing with their owners.

Compare the behavior with a known baseline for that account, device, application or network segment. A new country of login, unusual administrative action, unexpected service creation or abnormal data transfer is more significant when it differs from the normal pattern for that identity and role. A familiar event is not automatically safe; attackers can use legitimate credentials and normal tools.

Check visibility before drawing a conclusion

Record which systems were logging during the relevant period, their retention windows and any gaps caused by outages, configuration changes or overwritten storage. If a source was not collecting authentication, DNS, endpoint or cloud audit events at the time, state that limitation. “No evidence found” and “evidence was not available” are different findings.

3. Scope the environment systematically

Scope is the process of finding the boundaries of the event. Review evidence from the perimeter, internal network and endpoints, then add cloud and operational-technology systems where they are part of the affected service or could have been reached.

Perimeter and external access

Examine firewall, VPN, remote-access gateway, web-application, email-security, DNS, proxy and intrusion-detection records. Look for the first observed connection, repeated authentication failures followed by success, access from an unusual source, unexpected protocol use, large outbound transfers and traffic to infrastructure associated with the alert. Compare the times with account and endpoint events; a connection that cannot be tied to an approved user or service deserves escalation.

Rank #2

The Forensic Certified Public Accountant and the Halloween Identity Theft Ghost Employee (The Forensic Certified Public Accountant and ... Book 2)

$9.87

Buy on Amazon

Internal network and identity

Trace the account or host through directory, authentication, privilege-management, DHCP, DNS, router and network-flow records. Determine whether the identity was used on multiple systems, whether a privileged group changed, and whether a workstation contacted servers or administrative interfaces outside its normal role. Correlate provider records when a managed service, telecom operator or cloud platform holds the authoritative connection data.

Endpoints and servers

Review endpoint detections, process and service creation, scheduled tasks, startup items, script interpreters, file changes, local-account changes, removable-media activity and security-control status. Check servers that handle the same credentials or data as the initially reported device. If the device is still running, coordinate collection with a trained responder; abruptly shutting it down can destroy volatile evidence.

Cloud and software services

Use identity-provider, cloud-control-plane, storage, database, SaaS and API audit logs where those services are in scope. Look for newly created keys, tokens, OAuth grants, forwarding rules, role changes, disabled logging, unusual administrative locations and access to repositories or storage that the account does not normally use. Establish whether a cloud event came from a human, an automation identity or a provider-side operation.

Operational technology and safety-critical systems

If industrial-control, building-management, medical or other operational systems are connected to the affected environment, involve their owners before collecting or changing anything. Determine whether the activity could affect availability, process safety or physical equipment. Favor actions that preserve safe operation and follow the site’s engineering and continuity procedures.

Correlate, do not count alerts

A single signal rarely establishes scope. Join events by time, account, host, process, destination, token or transaction. Endpoint, firewall, proxy, router and service-provider records can corroborate one another even when one source is incomplete. Update the working scope whenever a new account, asset, persistence mechanism or data path is discovered.

Evidence sources and the questions they can answer

4. Preserve evidence and build a reliable timeline

Preservation supports verification, categorization, mitigation, reporting and later investigation. Secure logs against unauthorized access or deletion, follow the organization’s retention policy and make a read-only or otherwise protected copy for analysis. Preserve the original export and record the tool, query, time range, operator, system clock and file format used to obtain it.

Collect volatile information carefully

Memory, active network connections, running processes and temporary files can disappear when a system is powered off or rebooted. CISA’s ransomware guidance warns that volatile evidence and short-retention logs may be lost. When endpoint forensic analysis is needed, CISA’s playbook advises considering memory and disk imaging. Collection should be performed by trained responders using the incident plan so that containment, safety and business continuity are balanced.

A forensic write blocker can help prevent changes when a responder examines storage media, but it is a specialist tool for trained personnel, not a requirement for an organization trying to determine whether an alert is credible. Do not buy or deploy equipment without understanding the evidence procedure, authorization and chain-of-custody requirements.

Maintain an evidence register

For every item, record a unique identifier, source system, collection time and time zone, collector, method, hash or other integrity check when used, storage location, access permissions and each transfer or transformation. Keep working copies separate from originals. If an export is parsed, filtered or converted, retain the unmodified source and describe the transformation.

Rank #3

Mark Twain Forensic Investigations Workbook, Using Science to Solve High Crimes Middle School Books, Critical Thinking for Kids, DNA and Handwriting Analysis Labs, Classroom or Homeschool Curriculum

• Students build unmatched deductive-reasoning skills as they become crime-solving stars
• Most scenarios have more than one plausible outcome, allowing individuals or groups to broadly interpret evidence
• Includes interpretive handwriting, body language, fingerprinting, and many more activities

$13.04

Buy on Amazon

Use a timeline that another analyst can audit

Use one row per event with these fields:

• time and time zone;
• source and original event identifier;
• account, device, application or service;
• observed action or artifact;
• investigative action taken;
• result and confidence; and
• owner or evidence reference.

Normalize time zones explicitly rather than silently converting timestamps. Mark estimates as estimates. If two systems disagree, preserve both values and explain the clock difference instead of choosing the more convenient one.

5. Decide whether the event is confirmed

Use three practical states so that leaders understand what is known without overstating it.

Unconfirmed alert

The signal is plausible, but no independent evidence yet verifies malicious activity or the relevant activity may have an authorized explanation. Continue collection, verify the source and close visibility gaps. Do not label the organization compromised solely because a detection fired.

Verified malicious activity

One or more correlated artifacts show activity that is unauthorized or malicious—for example, an unapproved account use tied to a matching endpoint process and network connection. At this stage, document the evidence and affected assets even if impact is not yet known.

Confirmed impact

Evidence demonstrates that the actor reached or changed a system, credential, service, data set or operation, or that the organization cannot rule out such access because the relevant evidence was unavailable. State the type, extent and magnitude supported by the record. Identify what remains unknown rather than converting uncertainty into a precise claim.

Assess the dimensions of impact

• Access: Which initial access path and subsequent authentication methods were used?
• Assets: Which hosts, accounts, applications, cloud resources and operational systems were affected?
• Privilege: What permissions were available or obtained, and were they elevated?
• Persistence: Were accounts, keys, services, scheduled tasks, tokens, forwarding rules or other footholds created?
• Movement: Did the activity spread between endpoints, servers, tenants or network segments?
• Information: Was data viewed, copied, changed, deleted or made unavailable?
• Operations: Were customer services, internal processes, safety functions or recovery capabilities disrupted?

Revise the scope as evidence changes. A clean scan can support a finding about what was visible at scan time, but it cannot erase earlier evidence or compensate for logs that were never retained.

6. Contain without destroying the evidence you still need

Containment decisions affect evidence, availability and safety. Follow the response plan and coordinate with technical and business owners before disabling accounts, blocking addresses, isolating hosts, revoking tokens or taking services offline.

Choose the least disruptive effective action

Where safe, preserve volatile data before isolation. If an account is actively being abused, a coordinated disablement or credential reset may be urgent; record the approval, exact time and resulting loss of visibility. If a production server supports a critical process, use the continuity procedure and involve its owner. Never let the desire to collect perfect evidence expose customers or staff to preventable harm.

Check for residual access

After containment, review alternate accounts, API keys, session tokens, remote tools, scheduled tasks, forwarding rules and security-control changes. CISA advises considering third-party incident-response support when specialist expertise is needed to eradicate an actor and avoid residual access. Eradication should be based on evidence of the access path and persistence, not only on removing the first malicious file.

Rank #4

Test Results for Hardware Write Block Device: T4 Forensic SCSI Bridge (FireWire Interface) July 2009

$15.99

Buy on Amazon

When to investigate internally and when to bring in outside help

An internal team may be appropriate when it has authority, continuous access to the relevant systems, trained forensic staff and enough capacity to preserve evidence while keeping operations running. Outside support can add specialized collection, surge capacity, independence and experience with law-enforcement or legal requirements. A coordinated model often works when internal owners know the environment but need specialist analysis.

These criteria help select an approach; they are not a ranking of providers. Confirm conflicts of interest, confidentiality terms, data handling, deliverables and who owns the resulting evidence before work starts.

Reporting and notification

Reporting routes and deadlines depend on jurisdiction, organization type, sector, contracts, data involved and the facts established by the investigation. The federal incident-response playbook is written for U.S. federal civilian agencies; its agency obligations should not be presented as a universal private-sector rule.

U.S. organizations can report suspected cyber incidents through CISA’s online reporting route or 1-844-Say-CISA. CISA also directs organizations to local FBI field offices and the Internet Crime Complaint Center (IC3). Use current official contact pages when making a report because channels and guidance can change.

Ask counsel to map the facts to applicable duties involving regulators, customers, employees, insurers, contracts, sector rules and law enforcement. Preserve the report, the information supplied and the time it was submitted. If a deadline is uncertain, escalate the question rather than waiting for the investigation to become perfect; provide a qualified update when permitted.

Common mistakes that undermine an assessment

• Calling an alert a breach: classify the signal only after checking authorization and corroborating evidence.
• Relying on one tool: correlate identity, endpoint, network, application and provider records.
• Powering off a suspect system immediately: obtain volatile evidence first when safety and containment allow.
• Letting logs roll over: export and protect short-retention sources as soon as the incident is identified.
• Changing systems without recording it: log every reset, block, isolation, patch and configuration change.
• Ignoring cloud or operational systems: include them when they can reach or be reached from the affected environment.
• Confusing no observation with no exposure: state coverage gaps and expired retention explicitly.
• Eradicating only the visible file: check credentials, keys, tokens, services and alternate persistence.
• Reporting before coordinating: involve the incident lead, counsel and required owners so facts and obligations are consistent.

A practical incident-assessment worksheet

Use the following headings in the case record. They force a complete answer without implying certainty you do not have.

1. Trigger: What was reported, by whom, and at what time?
2. Hypotheses: What benign explanation and what malicious explanations are plausible?
3. Visibility: Which sources cover the period, and where are the gaps?
4. Corroboration: Which independent records support or contradict the alert?
5. Scope: Which accounts, assets, services, data and locations are involved?
6. Access and persistence: What entry, privilege, movement and foothold evidence exists?
7. Impact: What information, credentials, availability, safety or business process may be affected?
8. Actions: What was preserved, contained, restored or reported, by whom and when?
9. Unknowns: What cannot be determined because evidence is missing, altered or outside the retention period?
10. Next decision: What evidence or approval is required to close, escalate, notify or continue the investigation?

What a defensible conclusion sounds like

A final assessment should separate facts from interpretation. For example: “Between 02:14 and 02:31 UTC, the account authenticated to two servers from a source not associated with its normal role. Endpoint and firewall records show a matching remote process and connection. The account’s privilege was limited, and no evidence of data export has been found in the retained logs. Cloud audit coverage for the preceding seven days is incomplete, so access during that period cannot be ruled out. The event is verified malicious activity affecting the named account and servers; potential data impact remains undetermined.”

This format tells decision-makers what is established, what action was taken and what uncertainty remains. It also gives responders a clear basis for expanding the search, making notifications and deciding when the incident can be closed.

Quick Recap

Bestseller No. 1

Tableau Comprehensive Write Block Kit with SiForce Rugged Case (T8u, T7u, T6u, T35u, Tableau Adapters, USB Media Card Reader, Rugged Case)

$2,599.99

Bestseller No. 2

The Forensic Certified Public Accountant and the Halloween Identity Theft Ghost Employee (The Forensic Certified Public Accountant and ... Book 2)

$9.87

Bestseller No. 3

Mark Twain Forensic Investigations Workbook, Using Science to Solve High Crimes Middle School Books, Critical Thinking for Kids, DNA and Handwriting Analysis Labs, Classroom or Homeschool Curriculum

Students build unmatched deductive-reasoning skills as they become crime-solving stars; Includes interpretive handwriting, body language, fingerprinting, and many more activities

$13.04

Bestseller No. 4

Test Results for Hardware Write Block Device: T4 Forensic SCSI Bridge (FireWire Interface) July 2009

$15.99

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

CISA guidancecybersecurityDigital Forensicsincident responseintrusion investigationsecurity operations