Evidence-first incident response: what we put in every report
A finding without a timestamp and a source is a rumor. This is the exact record skeleton we use on every engagement — and why we refuse to ship anything less.
Why evidence first
In an incident, the report is the deliverable. Teams do not act on a feeling that something was anomalous — they act on a reconstruction of what happened, when, and on which system. The difference between a defensible report and a rumor is the record underneath it.
So we mandate the record before the narrative. Every assertion in a report resolves to a row: source system, collection method, timestamp, identifier, and what the artifact does not contain.
The record skeleton we use
That skeleton sounds administrative. It is not. The discipline is what lets two analysts reconstruct the same timeline from the same record, and lets a regulator check a finding a year later.
- UTC offset or timezone on every timestamp
- Source system and collection method for every artifact
- Relevant identifiers: hosts, accounts, sessions, case numbers
- Collection limitations — what the artifact does not cover
- A link to the original case or ticket
The boundary of evidence
Evidence is a bounded artifact. It cannot prove a compromise on its own, and it does not prove an environment is clean because nothing was logged. We write reports that say what is in scope, what is missing, and what telemetry would change the conclusion. Ambiguity declared beats confidence implied.
Bottom line
Every report we deliver can be traced to a record, and every record carries a source, a time, and a limitation. That is the whole discipline — boring on purpose, and defensible when it matters.