Transition to Uncover
Three phases complete. The next begins.
Alert answered what fired. Subject answered who acted. Scope answered how much of this matters. Uncover now answers what actually happened inside those bounds. The Scope-to-Uncover handoff is what stops Uncover from re-deriving the boundary instead of investigating within it.
What Scope hands forward
A Scope deliverable answers five questions Uncover needs before opening a query window.
What threat type are we investigating?
Determines which playbooks Uncover should reach for and which data sources are most relevant. A phishing-driven intrusion and a slow-burn insider produce very different Uncover workflows.
What time window applies, and to which entities?
Primary entities may get one window, secondary entities another, extended-look entities a third. Uncover queries reference these windows directly so the work stays inside the boundary.
Which entities are in scope, at what depth?
Full depth for primary entities. Baseline comparison for secondary. Out-of-scope entities documented explicitly so Uncover does not investigate them by accident.
What regulatory and infrastructure constraints apply?
Regulatory exposure assessed, with any notification clocks running in parallel under compliance ownership. Infrastructure gaps documented. Vendor or external-team requests in flight if needed.
What questions does Uncover need to answer?
The boundary says where to look; the questions say what to look for. Scope frames them explicitly, and the six standard question areas are covered in the next section.
The Scope output is a one-page document
A good Scope deliverable fits on a page. Threat An actor (or capability) with intent and means to cause harm. A vulnerability is what they exploit. Classical risk models multiply threat, vulnerability, and impact; ASSURED's RATM folds the threat and vulnerability questions into likelihood, so risk stays impact times likelihood. type, time windows, Entity Any discrete actor or object that evidence can attach to during an investigation: a user account, a host, a process, an IP address, a domain, a file. Triage decomposes an alert into its entities and asks what each one was doing; the same idea gives UEBA its E. lists, constraints, open questions. Any analyst joining mid-investigation should be able to read that page and know what is in, what is out, and what Uncover is being asked to find without having to ask.
Framing the Uncover questions
Uncover’s depth comes from working through specific investigative questions, not from running broad queries and hoping. Scope frames those questions before the data is even pulled.
🚪 Initial access
How did the attacker get in? Phishing, credential theft, vulnerability exploit, supply chain, social engineering. The answer drives where Uncover looks first.
🗺️ Scope of compromise
What systems were touched? What data was accessed? Uncover answers this by querying within the entity and time boundaries Scope set.
📌 Persistence
Are persistence mechanisms still active? Scheduled tasks, services, registry run keys, cloud automation, dormant accounts. The question shapes containment timing.
🔄 Lateral movement
Did the attacker move beyond the initial entry point? Across hosts, across identity boundaries, across cloud accounts. Drives the secondary-entity follow-up depth.
📤 Data movement
Was data exfiltrated? To where? Often the last question to surface in time-pressured triage, and the one with the largest impact on regulatory and business outcomes.
🎯 Intent indicators
What does the activity pattern suggest about the attacker’s goal? Ransomware staging looks different from espionage looks different from fraud. Intent shapes the response posture.
Common Scope-to-Uncover failure modes
A handoff can be done well in form and still fail in substance. Four patterns reduce the value of the work.
🪞 Repeating instead of bounding
The handoff document restates Subject’s entity map without making the in-scope vs. out-of-scope call. Uncover inherits ambiguity instead of a boundary and ends up redoing the scoping work.
📭 Missing the open questions
Scope hands forward a clean boundary but no framing of what Uncover should look for. Uncover starts with broad queries instead of focused ones, burning time on data exploration the methodology already specified.
🚧 Silent infrastructure gaps
Tools the SOC doesn’t have, retention that won’t reach back far enough, vendor data still pending. If those are not surfaced, Uncover finds out the hard way (often after writing the query that returns no data).
⏰ Regulatory clocks unmarked
Compliance triggers identified at Scope but not surfaced in the handoff. Uncover inherits a technical investigation without realizing a 72-hour clock is running in parallel. The investigation finishes; the notification window does not.
What 'good' looks like vs 'bad' in 30 seconds
Bad handoff: “Investigate everything around the workstation. PCI may apply.”
Good handoff:
Threat type: Malware Software whose author intends harm: ransomware, trojans, worms, viruses, spyware, wipers, rootkits, RATs. The B.A.D. glossary catalogs the families in detail. suspected; Initial Access The first step of a breach, where attackers gain a foothold in the environment through phishing, exploits, credential abuse, or exposed services. likely email-driven. Time: alert −24h through current, primary entities only. Extension requires evidence. Primary: WS-MKT-042, User The identity behind activity on a system: the account that authenticated, launched the process, or received the email. In triage the user field names an account, not necessarily a person; whether the legitimate owner was actually behind the activity is exactly the question stolen credentials raise. mjones (full depth). Secondary: DC01 (mjones authenticated there 09:14), file Server A host whose role is to provide services to other systems rather than to a person at a keyboard. The distinction drives triage: web browsing and office documents are routine on a workstation but anomalous on a server, an interactive server login warrants checking who made it since only administrators should have a reason to, and a compromised server typically exposes data or downstream users at scale. share \\fs01\marketing (mjones accessed 11:02). Both baseline-comparison only unless something surfaces. Out of scope: other marketing workstations, BYOD phone (no Telemetry Collection and transmission of security-relevant data from remote sources for monitoring and analysis. ), other VLANs. Regulatory: none triggered. Revisit if scope expands to systems handling regulated data. Tools: EDR primary, SIEM corroboration, network analysis for egress, TI passive only. Open questions: (1) how did the binary land on WS-MKT-042; (2) did it persist; (3) any C2 callbacks observed; (4) any Lateral Movement Adversary traversal from the initial-access host to other hosts inside the environment. Each hop expands the blast radius and adds new entities for Subject analysis. Often piggybacks on legitimate authentication, which is what makes it hard to detect. attempts; (5) was any data staged or exfiltrated. Time budget: 4 hours initial, reassess at 16:00.
The good handoff is what lets Uncover open the first query inside the rails and finish on time. The bad handoff is what guarantees the next four hours are spent reading instead of investigating.
Key Takeaway
Scope is invisible when it works: Uncover starts inside the boundary, the investigation finishes on time, and the case ends with a complete, defensible record. The handoff itself is a one-page document, a set of framed investigative questions, and a clear answer to “is this still our investigation if we cross this line?”