Simple explanation
Just like vulnerability reports, incident reports need a consistent structure so nothing critical falls through the cracks — this lesson covers what belongs in one.
Technical explanation
- Executive summary — a brief, business-focused overview of what happened and its impact, for an audience that won't read a full technical timeline.
- Incident timeline — a detailed, chronological record of events: when the compromise likely began, when it was detected, key actions taken and when, and when it was resolved. This is often the single most valuable artifact for both internal learning and any external/legal requirement.
- Impact — what was actually affected: systems, data, users, financial cost, downtime.
- Root cause analysis — the "why" behind the incident, feeding directly into the post-incident lessons-learned process covered in Domain 3.
- Evidence — properly preserved artifacts (logs, forensic images, packet captures) supporting the report's conclusions, maintained with proper chain of custody in case they're needed later.
Synonyms / related terms
| Term | Means | |---|---| | Incident timeline | Chronological record of an incident's key events | | RCA | Root Cause Analysis | | Chain of custody | Documented handling record for evidence, relevant to how evidence is referenced in the report |
Concept Check
"An incident report describes the malware found and the systems affected, but doesn't establish when the initial compromise actually occurred relative to when it was detected." This report is missing the incident timeline — without it, there's no way to answer critical follow-up questions like how long the attacker had access, or whether other systems might have been touched during that window.
Interview-style Q&A
Q: Why does an incident timeline matter even after the incident is fully resolved? A: "Beyond internal learning, it's often required for regulatory notification (many breach laws require reporting the discovered timeline of compromise), for insurance claims, and sometimes for legal proceedings. It's also the primary tool for calculating dwell time — how long an attacker was present before detection — which is one of the most telling metrics of how well detection capability is actually working."
Memory trick
"Summarize, Sequence, State the Impact, Seek the Cause, Save the Evidence" — the five S's of a complete incident report.