Evidence
Evidence is the information you base your decision on. Not all of it is equally important.
Example of Evidence
Login to employee account from a new IP at 09:14 AM.
Why does it matter?
A decision without evidence is an opinion. A good decision links at least two pieces of evidence.
Common Mistake
Only reading the alert title without opening the detailed evidence.
Timeline
The order of events reveals the full story — sometimes it's more important than the events themselves.
Example of a Timeline
09:14 — Login attempt
09:16 — Session established
09:21 — User reports they did not log in
Ask yourself:
- What happened first?
- Is the situation escalating over time?
- Is there a suspicious time gap?
Affected User
Who is the person at the heart of the event? Their role and seniority are indicators of risk.
Example of an Affected User
Name: Ahmed Salem
Department: Finance
Seniority: 1.5 years
Previous Incidents: None
A user in a sensitive department (like Finance or HR) warrants a higher degree of caution.
Affected Asset
The system, account, or service. Its criticality determines what level of containment is acceptable.
Example of an Asset
Asset: Microsoft 365 Account
Type: Digital Identity
Criticality: 4/5
An asset with 4/5 criticality means disabling it affects more than one person's work — it requires approval before drastic decisions.