STAGE 1: Understand the environment
Concept: A security event needs asset and account context.
Task: Map the portal, identity service and relevant log fields.
Acceptance: Use fictional accounts and documentation-reserved example addresses.

My assumptions:

My work / file link:

My checks and results:

What I changed:


STAGE 2: Build the timeline
Concept: Events become useful when timestamps and identities are consistent.
Task: Normalize timestamps and order the supplied events; distinguish facts from hypotheses.
Acceptance: A failed login alone is not proof of compromise.

My assumptions:

My work / file link:

My checks and results:

What I changed:


STAGE 3: Assess and escalate
Concept: An analyst should connect evidence to a defensible severity decision.
Task: Write the impact questions, evidence gaps and escalation recommendation.
Acceptance: Avoid unsupported attribution to a person or group.

My assumptions:

My work / file link:

My checks and results:

What I changed:


STAGE 4: Recommend defensive controls
Concept: A useful response balances containment and operational impact.
Task: Propose account review, stronger authentication and log retention checks for authorized owners.
Acceptance: Do not attempt credential attacks or test a real third-party system.

My assumptions:

My work / file link:

My checks and results:

What I changed:
