how to get better at investigations
started my internship about a month ago as a incident responder and my manager is pretty tough. he gives good critiques on how i do my investigations (specifically on my notes). i think my main trouble is coming to a proper conclusion. in investigation theory, i learned that its important to understand 1. what/why the incident fired 2. coming up with a hypothesis 3. gather evidence to prove/disprove hypothesis 4. come to a conclusion. i think im having trouble with looking for the right evidence (security logs) to come to the right conclusion. i often waste time looking at everything.
anyways, i wanted to just get some advice on what i could do better in investigation, and how i can be a better analyst. i appreciate all the help.
u/BuffaloLlama124 — 4 days ago