Triage: when the package is enough to write the finding

Start from the sentence the finding must support

Write the question in one line before you decide the package is thin. “Which account created the DailyInventory task on ACCT-04 during the lab window?” needs different files than “What is every program on disk?” A package is complete relative to a question, not relative to what the tool is able to copy.

List the artifacts that can answer that question: the task file, the event that records creation, and the copy log lines that show those files are actually in this package. Anything not on that list does not block the finding.

Present, missing, or deferred

Walk the copy log for each path on the list. Present and not deferred means you may cite it. Deferred means you do not yet have the bytes; say so. Not listed means this target did not bring it back. Do not fill that hole with a guess from a rule title.

If a timeline or a hunt was run, use it only to point at rows you can open. A hit without the underlying event still in the package is a lead, not the citation.

The stop rule

You stop when each factual sentence cites a row: a copy-log line, a timeline row with its timestamp description, or an event id with the field you quote. Every question you cannot answer becomes one gap sentence: what is missing, and whether you will request that single artifact or leave the gap.

A further target, a memory image, or a full disk does not become mandatory because it is possible. Request it only if a gap sentence blocks a claim you still intend to make. Record that choice next to the question so the next shift does not restart from zero.

Worked case: the task-creation question

The question is who created DailyInventory on ACCT-04. The copy log lists the task file and Security.evtx, neither deferred. The event export shows 4698 with that task name and the subject account used by desktop engineering. The finding quotes those two rows and the copy-log paths, and it stops.

On a second lab image, Security.evtx is not in the log. The task file is present, so you can say the task exists in the package, and you write the gap: the creating account is not in this collection. You either request the Security log under the same approval or you publish the gap. You do not hold the finding for a full disk copy that the question never needed.

Snippet

question: which account created DailyInventory on ACCT-04?
cite: copy log has Security.evtx (DeferredCopy false)
cite: 4698 TaskName DailyInventory, subject account as recorded
gap: none
stop: yes

Diagram

Enough to write, or a named gap

Question
One sentence the finding has to support.
Note
```
who created DailyInventory
```
List
Only the artifacts that can answer it.
Note
```
task file, 4698, copy-log lines
```
Check
Present, deferred, or not in the package.
Log
```
Security.evtx DeferredCopy false
```
Stop
Cite rows, or write the gap and stop.
Decision
```
no full disk “just in case”
```

Check yourself

1. When is a triage package complete enough?

2. The question needs the creating account, and Security.evtx is not in the copy log. What belongs in the finding?

3. An extra artifact would not change the question. What should you do?