// THREAT DETECTION AND DATA PRIVACY TERM
Investigation
An investigation is the process of collecting and analyzing digital evidence to understand the full scope of a security incident. The goal is to determine how the attacker got in, what they did, and what data or systems were affected.
TECHNICAL DEFINITION
A core phase of the incident response (IR) lifecycle, a cybersecurity investigation involves systematic digital forensic analysis of evidence, such as logs, memory dumps, and network traffic, to perform root cause analysis (RCA). The objective is to identify the attack vector, determine the scope of compromise, attribute the activity to a threat actor, and assess the business impact to inform containment and remediation strategies.
BACKGROUND
The Cybersecurity Maturity Model Certification (CMMC) is an assessment framework and assessor certification program designed for a variety of standards published by the National Institute of Standards and Technology.
READ MORE ON WIKIPEDIASYNONYMS & ALIASES
- forensic analysis
- incident analysis
- security inquiry
- root cause analysis (RCA)
- digital forensics
- post-incident review
- threat analysis
USAGE NOTE
The investigation's findings are documented in an incident report, which is crucial for legal proceedings, regulatory compliance, and improving future security measures.
DEVELOPERS
Organizations developing technology related to Investigation.
Develops big data analytics platforms like Gotham, used by government agencies, intelligence, and law enforcement for complex investigations by integrating and analyzing disparate datasets.
Provides blockchain analysis software and services to government agencies, financial institutions, and cybersecurity companies to investigate and trace illicit cryptocurrency transactions.
A part of Google Cloud, Mandiant is a leader in incident response and threat intelligence. They provide services and a platform to investigate complex cyber breaches and understand adversary tactics.
A global leader in digital forensics technology, providing hardware and software for extracting, decoding, and analyzing data from mobile devices, computers, and drones for criminal and corporate investigations.
An intelligence company that provides a platform collecting and analyzing vast amounts of data from open, dark, and technical sources. This intelligence is used by investigators to gain context on threats and adversaries.
Develops digital investigation software that recovers and analyzes evidence from computers, mobile devices, and cloud services. Their platforms are used by law enforcement and enterprises to conduct digital forensics.
While known for endpoint protection, its Falcon platform provides extensive endpoint detection and response (EDR) capabilities, which are crucial for security teams to investigate intrusions and hunt for threats within their networks.
An independent investigative collective that pioneers the use of open-source intelligence (OSINT) techniques and tools for investigating a variety of subjects, from armed conflicts to criminal activities.