# Security incident report

<!--
Blank template from https://www.pastepile.com/security-incident-report-template
Replace every bracketed line. Delete a section only if you say why in
"How this was produced". Times in UTC.
-->

- **Reference:** [case or ticket reference]
- **Issued:** [YYYY-MM-DD HH:MM UTC]
- **Prepared by:** [name, team]
- **Prepared for:** [client or internal audience]
- **Distribution:** [who may read this report]

## 1. What was examined

- Evidence received: [each item, e.g. "Defender advanced hunting export (CSV), 22 records"]
- Time covered by the evidence: [first record UTC] to [last record UTC]
- Systems and accounts in scope: [hosts, tenants, mailboxes]
- Out of scope: [anything you did not collect, query or have access to]

## 2. What was found

Repeat this block for each finding, most severe first.

### [Finding reference]: [one-line statement of what happened]

- **Severity:** [high / medium / low] and why
- **What the evidence shows:** [host, account, time, action, in plain language]
- **Why it matters:** [what this behavior usually indicates]
- **Records cited:** [evidence and record references, e.g. "E-065, ProcessCommandLine"]
- **What it does not establish:** [the question this finding leaves open]
- **Recommended:** [the next step, and when it applies]

### Machines and accounts involved

[hosts], [accounts]

## 3. What could not be determined

- [Question the evidence cannot answer] (needs [evidence that would answer it])
- [...]

## 4. What we recommend

1. [Action], only if [condition, e.g. "this activity was not expected or authorized"]
2. [...]

## 5. What was checked

- [N] checks ran against the evidence supplied.
- [N] could not run because the evidence they need was not supplied:
  - [evidence type]: [N] checks
- A check that could not run is not a check that found nothing.

## 6. How this was produced

- Tools and methods: [what was used to parse and analyze the evidence]
- External lookups: [none / which providers, on whose instruction]
- Detonation or sandboxing: [none / what, where]
- Use of AI: [none / where and how it was reviewed]
- Limitations: [anything that affects confidence in the findings]