Transition to Uncover

About 3 min read

On this page

S Transition

Scope drew the formal boundary. Uncover steps into that boundary and starts pulling evidence. This page is the bridge: what to hand forward, how to frame the open questions, and what to leave behind.

What Scope hands forward

A one-page boundary statement. Start from the scope-boundary.md template; Case A’s is filled in on the worked example. It answers eight questions, so an analyst joining mid-case knows what is in, what is out, and what Uncover is looking for:

1. Threat type: which playbooks and data sources Uncover reaches for.
2. Windows: primary, extended and forward, in UTC, each with its anchor event and a retention check.
3. Entities and sweeps: primary at full depth, secondary at baseline, downstream and originating threat placed, sweeps as bounded queries, and what is out, each with its reason.
4. Constraints: regulatory tags with candidate timestamps and the time each owner was engaged; named visibility gaps (a source the SOC cannot see is a gap, not an out-of-scope decision); requests in flight.
5. Open questions for Uncover (below).
6. Escalation posture: containment status and the findings that would fire the escalation tripwire. If it has fired, say so: IR owns the case.
7. Preservation: what is held, hashed or paused, so Uncover knows what still exists.
8. Time box: when Uncover converges, re-scopes, or pulls in a peer or tiers the case up (escalation to IR runs on the criteria and the matrix, not on elapsed time), sized from the time guidance.

Depth and the close path

Scope never closes a case; the Escalation decision does, and a confirmed criterion is an early E decision from here as from any phase. A narrow boundary is what makes a fast, defensible close possible (Case B). Level 0 has no Scope step: the eligibility gate stands in for it. Level 1 compresses Scope to three lines inside the context sweep: the window and its anchor; the subject and what is excluded; any regulatory flag and named gap. Level 2 gets the full statement. The depth ladder only moves up.

Framing the Uncover questions

Uncover’s depth comes from specific questions, not broad queries: initial access; extent of compromise; persistence (including OAuth consent grants, mailbox rules, new MFA methods or devices, IDE extensions and MCP servers); lateral movement; data movement; and intent. Each open question in the statement should map to a query Uncover can run.

A good handoff vs a bad one

Bad: “Investigate everything around dlin’s laptop. PCI may apply.” Good: Case A’s boundary statement, with its most expensive line corrected. It records that the page had not gone out; it should read “escalation tripwire met at 09:24 (criterion 1); IR paged and owns the case; Uncover runs as scoping support.”

When Uncover hits the line

Stop at the boundary, write the three-line justification (evidence, risk, required actions: the entity decision tree), and extend the statement with a timestamp. Clearing works the same way: an entity the evidence clears leaves with its reason recorded. A confirmed criterion fires the escalation tripwire; suspicion only refines Scope.

You are ready for Uncover if

• Another analyst could run Uncover’s first query from the statement alone: every entity in or out with a reason, every open question mapped to a query.
• Every gap, hold, request and regulatory timestamp has a time on it, and the escalation posture says who owns the case.