Uncover: Pulling the evidence
On this page
Investigate stage · phase 4 of 7
What does the evidence say?
Uncover is where the investigation does its work. With Alert, Subject, and Scope established, this phase pulls telemetry Telemetry The event streams that endpoints, network sensors, identity providers, SaaS apps and cloud control planes emit about what happened on them. Triage can only see what was collected: when telemetry is missing for a host or time window, record it as a gap (unknown is not Low), not as clean. , correlates it, identifies anomalies, and reconstructs the chain of activity from first action to last. The output is a coherent narrative supported by evidence.
What Uncover is for
Alert, Subject, and Scope told the analyst what fired, who was involved, and where the lines are. Uncover is where the analyst actually answers the question: what happened, who or what did it, and what did it touch, including the real possibility that the activity is legitimate. Uncover ends with a narrative the analyst can defend.
The boundary with Subject is worth stating plainly. Subject runs bounded, entity-centric lookups (identity, privilege, recent authentication, baseline) to answer who acted and whether it is normal for them. Uncover runs activity-centric, multi-source queries to reconstruct what happened. If the query is about the entity, you are in Subject; if it is about the activity chain, you are in Uncover.
What you will get from this chapter
By the end of Uncover you should be able to:
Pick a source by the question it answers and know where its coverage and retention end: Data sources.
Correlate evidence into one timeline with join keys, clock-skew checks, confidence labels, the hypothesis ledger, and the rules that say when to stop digging: Correlation and the timeline.
Use threat intelligence without being used by it: validate a match, enrich without leaking, and label attribution at the confidence the evidence earns: Threat intelligence.
Map findings to MITRE ATT&CK at the most specific technique the evidence supports, so the chain has a shared vocabulary the rest of the team can use: MITRE ATT&CK.
Choose the right tool at the right step: log search, endpoint, identity, cloud, network, sandbox and automation platforms: Choosing tools.
When Uncover is done
Uncover is finished when the case file holds the six things Risk needs, described on the Uncover-to-Risk transition:
- The evidence chain: what happened, in order, with timestamps, each step tied to the source that showed it and mapped to ATT&CK where it applies.
- Entity verdicts: which of Scope’s entities were involved and which were investigated and ruled out, each with its evidence.
- Intelligence context: which intel matched, at what confidence, and whether it stayed a hypothesis or was borne out by your own telemetry.
- Coverage gaps: what could not be examined (missing telemetry, expired retention, blind sensors) and why.
- Detection gaps: techniques observed but not flagged automatically, written so detection engineering can act on them.
- The hypothesis ledger: every hypothesis with its status, refuted ones included, plus the dry-thread checks for any thread closed on empty results.
Uncover at a glance
- Question
-
What does the evidence say?
- Deliverable
- The six-part case file listed under “When Uncover is done”, handed to Risk.
- Done when
- Risk could rate the case from the file alone. Every entity Scope named has a verdict or a recorded coverage gap, and each open thread has met the stopping rules.
- Tripwire
- A canonical criterion confirmed at High confidence partway through Uncover makes the case P1 and escalates it then, as an early Escalation decision; the remaining evidence work continues under IR’s clock. Suspicion refines Scope instead. The escalation criteria page states the rule.
| Level | At this level, Uncover is |
|---|---|
| Level 0 pattern close | Does not run. The analyst checks the pattern’s discriminators and the eligibility gate against their source systems. A case that needs new evidence gathering is no longer a Level 0 case. |
| Level 1 standard triage | Narrowed to the one question the verdict turns on, answered from telemetry already at hand. If answering it needs a second subject, a privileged account, or new collection, or something suspicious survives without a defensible verdict, the case moves to Level 2. |
| Level 2 full arc | Runs as this chapter teaches it, with the Scope, Uncover and Risk loop repeating until the residual risk is understood. The full-arc time in the chapter hero is for this level. |
Why Uncover deserves its own phase
- Evidence is plural: Endpoint Endpoint A device that runs an operating system and applications and connects to the network: workstation, laptop, server, virtual machine, phone, tablet. Endpoints are where execution-based tradecraft (malware, scripts, hands-on-keyboard commands) shows up, which is why EDR exists. Identity, SaaS and cloud-control-plane attacks, and attacks on network appliances that cannot run EDR, may never touch one, so endpoint silence is not proof of absence. telemetry alone is rarely enough, and network logs alone are rarely enough. Uncover is the phase that brings sources together, so the analyst can answer a question the way only correlated data can.
- ATT&CK is the vocabulary: mapping findings to MITRE ATT&CK MITRE ATT&CK MITRE's public knowledge base of adversary tactics, techniques and procedures observed in real intrusions, with Enterprise, Mobile and ICS matrices. Enterprise v19 (April 2026) split Defense Evasion into Stealth and Defense Impairment. Triage uses it as a shared vocabulary: map what the evidence shows to technique IDs, record the version, and remember that a mapping names behavior without scoring it. See the ATT&CK Tactic, Technique and Procedure entries. turns “the attacker did this and then this” into “T1566.001 → T1059.001 → T1071.001”. That precision matters at handoff and in trend analysis. For a non-technical audience, translate it back into tactic names (Initial Access → Execution → Command and Control).
- Intel is a hypothesis source: threat intelligence Threat Intelligence Evidence-based knowledge about existing or emerging threats, including context, mechanisms, indicators, implications, and actionable advice (after Gartner's widely cited definition). It is consumed at strategic, operational, and tactical levels. Before acting on it, weigh the source's reliability, the information's credibility (the Admiralty code is one common scheme), and its age. is most useful as a hypothesis generator, not as ground truth. Uncover uses intel to decide what to look for, then validates it against the evidence in the environment.
- Tools serve the question: a common Uncover failure is starting with a tool (“let me run a SIEM SIEM (concept) Aggregation and correlation of security event data for centralized detection, compliance, and IR. query”) instead of a question. The method asks what the analyst needs to know, then chooses the tool that can answer it.
Key takeaway
Uncover is the longest phase of a full-arc investigation, and the one where the earlier phases pay off most. Strong Alert, Subject, and Scope work means Uncover is structured. Weak earlier phases mean Uncover wanders.
Next up
Data sources
The evidence sources an Uncover investigation pulls from, which question each one answers, and where its visibility ends.
Read data sourcesTechnical details verified . Product names, defaults and retention change; check your own tenant.