Incident Investigation

Definitions

1. The evidence-driven effort to determine what happened during a security incident, how the attacker or failure path worked, and what data or systems were affected. Incident investigation often combines logs, endpoint data, cloud records, and forensic artifacts.

   In plain English: Looking into a security incident to understand what happened and how.

   Example: "The incident investigation found the initial foothold came from a compromised contractor VPN account."

Related Terms

• Computer Forensics
• Digital Forensics
• Incident Forensics
• Memory Forensics
• Network Forensics
• Cloud Forensics
• Compromise Assessment
• Data Recovery
• Disk Forensics
• Forensic Analysis
• Forensic Investigation
• Forensic Toolkit
• Header Analysis
• Incident Timeline
• Live Forensics
• Log Analysis