Categorize case-note statements as evidence, assumption, or next collection task.
Classify each case-note line by what it represents. Evidence Assumption Next collection task Okta shows successful MFA push at 08:42 from ASN 64512 The user probably approved a prompt they did not initiate Pull mailbox audit logs for inbox rule creation after 08:42 EDR recorded powershell.exe spawned by winword.exe The macro was likely delivered by the invoice email Search proxy logs for the document download URL No lateral movement events found in the first 12-hour query The attacker may have used valid credentials before the endpoint alert
Sign up free — one personalized lesson every day, matched to your role and goals.
Already have an account? Sign in