Incident follow-up | Client form

Section 1 of 4

Who should we follow up with?

Fields marked * are needed. You can leave the rest blank if you don't know yet.

Client / company / site

Location or affected serviceUse whichever helps us identify where this happened.

Your name *

Your role

Email

Phone

Leave at least one way to reach you: email or phone.

Prefer a paper form? Download the fillable PDF

Section 2 of 4

What was found?

1. What happened, and who raised the alarm?

Tell us what was actually reported. You can attach the report or screenshots at the end.

What happened? *

Who reported it?

Report or ticket number

2. When did it happen?

First seen: date and time

Last seen: date and time

Time zone

Is it still happening?

3. Where was the activity seen?

Check what is known. If nobody has established that yet, use "Not established".

Internet / provider network Router / firewall / VPN Computers / servers Email / cloud accounts Cameras / door access / other devices Not established

Which way was the activity going, if known?

4. Which accounts, systems or addresses were involved?

Names, email accounts, device names, IP addresses or ports, if known. How were they linked to this client or site?

Section 3 of 4

What got through, and what changed?

5. Did anyone actually get in? What backs that up?

Only blocked attempts found Traffic passed; access not confirmed Unauthorized access confirmed Not established

Who checked, and what record supports that answer?

6. What is affected right now?

Name the systems that matter here. Mark only what has actually been checked.

What was found, and what is the impact?Include when it was checked and the record behind it. "Still working" alone does not rule out access.

7. What has already been done?

Who did what, and when?

Section 4 of 4

Send the records behind it.

8. What can you attach, and what is still missing?

The original report or email is a good start. Add relevant logs or screenshots already collected.

Choose supporting filesUp to 5 files. 10 MB each, 25 MB in total.PDF, pictures, text / log files, ZIP, PCAP or email files. Files are stored as records, not opened or run here.

What is still missing, who is getting it, and when?

Save original logs before resets or clearing records. Send copies. Leave out passwords, recovery codes and unrelated personal information.

Tell us what happened.