Investigation workflow
A repeatable loop through frame, collect, analyze, decide, validate, and record, plus a prompt pattern that works.
Last updated · September 2026
On this page
Use this loop for repeatable investigations. It keeps analysis useful to both the person running the case and the person reviewing it later.
| Phase | Operator responsibility |
|---|---|
| Frame | State the decision that must be made, the time window, business context, and severity. |
| Collect | Identify sources, preserve original timestamps, and note gaps or collection failures. |
| Analyze | Ask for facts, hypotheses, confidence, alternative explanations, and the next discriminating check. |
| Decide | Choose a reversible, least-privilege action where possible. Escalate high-impact actions. |
| Validate | Confirm that the action achieved its objective and did not create a new exposure. |
| Record | Save the finding, evidence references, owner, timestamp, and follow-up work. |
Prompt design pattern
Investigation prompt templatetext
Role: incident responder Objective: determine whether the alert represents a likely compromise Scope: workstation-042, 2026-09-12 18:00-22:00 UTC Evidence: [paste alert, process tree, user sign-in records] Constraints: do not invent telemetry; distinguish fact from inference Output: 1. Executive assessment 2. Observed facts 3. Hypotheses with confidence 4. Missing evidence 5. Reversible next actions 6. Escalation criteria
Was this page helpful?