Investigation Workflow
What is it?
The workflow turns events into a case: from one alerting event, gather the related events by account/host/time, order them, and answer who / where / when / did it succeed / what happened next.
Why it matters
A single event is a fragment; the ordered timeline across events is the answer a responder needs to scope and act. Events without a timeline mislead.
Where you see it
Pivoting from a 4624 (foreign logon) on an account to that account's 4672, 4720, 4732, 4688 and 1102 across hosts, ordered by time.
What normal looks like
A benign timeline where each event has an innocent neighbour — a login, expected admin work, a scheduled task.
What suspicious looks like
A causal chain: foreign logon → privilege → new admin account → encoded execution → log-clear, one account across hosts within minutes.
How analysts investigate
Pick the shared key (account or host), gather its events, order by time, read the story for cause and effect, and end with who/where/when/success/next as one defensible statement.
Common beginner mistakes
- Escalating one scary event without the surrounding timeline.
- Correlating on time alone and mixing two accounts' events.
Events → one timeline → a verdict
key = account svc-helper, ordered by time:
02:14 4624 foreign logon (Tor src)
02:15 4672 privileged
02:20 4720+4732 new admin account
02:21 4688 encoded PowerShell
02:30 1102 Security log cleared
who/where/when/success/next → a defensible incidentQuick check
Which is a defensible conclusion from Windows events?
A quick self-check — it doesn't affect your XP or progress.
Sign in to save your progress on the server.