CFCONTROL//FORGEOperational investigation cases
Runs locally in your browser
Case library

Pre-investigation file // LEVEL 01

The Unopened Door

Access request to an internal vendors space. The requester claims not to know the link, but the record shows the link found its way to them.

Trail of an Exposed Link / 1Ready to investigate
Incident context

Learn to distinguish between a suspicious access attempt and accusing a user before the evidence is complete.

Investigator missionExamine the trail first. Identify what should be contained and what should be preserved before interpreting intent or blaming someone.

Before you begin

  1. 01

    Establish the access trail

  2. 02

    Preserve evidence

  3. 03

    Choose proportionate containment