Scope: Defining investigation boundaries
On this page
Orient stage · phase 3 of 7
Where are the lines?
Scope decides what is in the investigation and what is out. Without it, investigations sprawl indefinitely. With it, analyst time goes to the questions that matter for this case.
What Scope is for
Subject produced a map of identities and relationships, with a provisional primary, secondary and downstream classification. Scope takes that map and draws the formal boundary: which regulations constrain the work, which time windows apply, which entities are in this investigation, and which infrastructure Infrastructure The systems, networks, and services that computing runs on. In triage the word points two directions: the organization's infrastructure is what alerts fire on, and attacker infrastructure is the set of C2 servers, domains, and staging hosts an adversary operates, which pivoting on indicators is meant to map. paths get walked. Without scope, Uncover has no idea where to look.
Regulatory comes first not because it is most important, but because its clocks may already be running: tag it from Subject’s map now, and refine it as the entity boundary firms up. The boundary is not fixed once drawn either. When Uncover or Risk surfaces a new entity, a new window, or a new regulated data class, Scope redraws it, in both directions; that loop is the method working.
What you will get from this chapter
Recognize which regulatory frameworks may attach (GDPR, California’s privacy and breach laws, PCI DSS, HIPAA, SOX, SEC disclosure, and the shorter EU and sector clocks) and record the timestamps their clocks run from, with the regulatory clock card as the lookup table.
Set defensible time windows for historical review and real-time investigation, calibrated to the threat type.
Decide which entities are in scope and how to handle access modeling, dependency tracing, and relationship mapping.
Recognize the infrastructure boundaries that constrain what an investigation can actually see.
The four boundary types
Regulatory boundaries
GDPR, CCPA and California's breach law, PCI DSS, HIPAA, SOX, SEC disclosure, with pointers to NIS2, DORA and the sector clocks on the regulatory clock card. The clocks, preservation duties, and owners that attach to regulated data.
ReadTime boundaries
Historical review windows, real-time investigation, retention limits. When the investigation starts and stops.
ReadEntity boundaries
Primary and secondary entities, relationship mapping, access modeling, dependency tracing. Which subjects are in.
ReadInfrastructure boundaries
What the SOC actually has visibility into. Network segments, cloud accounts, geographic regions, retention.
ReadScope at a glance
- Question
-
Where are the lines?
- Deliverable
- The boundary statement: one page covering the threat type, the windows, the entities in and out, regulatory tags with their candidate timestamps, visibility gaps, preservation, open questions and a time box. Start from the Scope boundary template.
- Done when
- Every entity in the boundary has a category, a depth and a one-line justification. Each window has an anchor event and a retention check. Every regulatory tag has its candidate timestamps and an owner engaged. Every gap is named. Uncover has its questions and its time box.
| Level | At this level, Scope is |
|---|---|
| Level 0 pattern close | No separate Scope. The eligibility gate’s items (asset criticality, privilege, regulated-data reach), each proven from its source system, stand in for it. An item that fails or cannot be proven ends Level 0. |
| Level 1 standard triage | Subject and Scope run as one sweep, and Scope is the three-line minimum below. |
| Level 2 full arc | The full boundary statement across all four boundary types, versioned each time Uncover or Risk sends the case back. |
Minimum viable Scope
A Level 1 case gets three lines instead of a page: the window and its anchor; the subject and what is excluded; any regulatory flag (or a documented “none”) and any named gap. If any of those will not fit on one line, the case has outgrown Level 1. Regulated data merely in reach is a Scope flag. Regulated data plausibly accessed by the activity under review is what moves a case to Level 2.
Why Scope is its own phase
- Without scope, investigations sprawl. Analysts who skip Scope follow every interesting thread. Each one feels productive; by the end of the shift three are open, none is resolved, and the alert that started it is still waiting for a decision.
- Compliance lives at this step. An account that touched HIPAA-bound data carries different obligations than a developer’s sandbox. Scope recognizes those obligations before Uncover starts touching data that has rules attached.
- Time is a boundary, not a default. A fast-moving intrusion may need a day of lookback; a slow-burn insider case may need six months. The window is a choice about the threat, not a SIEM setting.
- Visibility is finite. Air-gapped systems, SaaS without logging access, off-network devices: naming the gaps up front keeps Uncover from spending time on queries that cannot be answered.
Key takeaway
Scope is the phase that says “this and not that.” It covers four boundary types (regulatory, time, entity, infrastructure) and produces one page of output: the clocks, windows, entities, and visibility limits that every later phase works within.
Next up
Regulatory boundaries
GDPR, CCPA, PCI DSS, HIPAA, SOX, SEC disclosure. The rules that shape investigation.
Read regulatoryTechnical details verified . Product names, defaults and retention change; check your own tenant.