Investigate client security

When to use

Use this guide when you need to collect and correlate security evidence for one customer, then prioritize remediation.

What you need

Replace these bracketed values before you copy the prompt.

• concernRequired

  Security alert, incident, user, asset, or question to investigate.

• time windowOptional

  Optional bounded time window.

Information used

Stackyapper uses only the Apps and permissions available to the current user.

• Security findingsRequired
• Security assetsIf available
• Identity securityIf available
• User directoryIf available
• Managed devicesIf available
• Device alertsIf available
• Service ticketsIf available
• DocumentationIf available

Expected output

• Customer scope
• Evidence and freshness
• Missing coverage
• Severity and confidence
• Recommended containment and remediation

Steps

1. Confirm the customer, concern, time window, and affected identity or asset.
2. Collect relevant findings and the associated asset context.
3. Correlate identity alerts and user state when relevant.
4. Check related device evidence, active RMM alerts, tickets, and approved runbooks.
5. Report evidence, uncertainty, severity rationale, containment options, and actions requiring approval.