The process of gathering evidence and information that allows for the creation of a theory of events explaining a security incident.
The process of gathering evidence and information that allows for the creation of a theory of events explaining a security incident.