Chapter 14 — Case intake, scope and ownership methods
Lesson map
Lesson 14 published. Map, example, EX040.
flowchart TD
N0["Learning outcomes and connection"]
N1["14.1 Intake channels"]
N2["14.2 Intake questions"]
N3["14.3 Scope statements"]
N4["14.4 Ownership"]
N5["Chapter synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX040"]
Logical drawing
flowchart LR
N0["Learning outcomes and connection"]
N1["14.1 Intake channels"]
N2["14.2 Intake questions"]
N3["14.3 Scope statements"]
N4["14.4 Ownership"]
N5["Chapter synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX040"]
[Learning outcomes and connection]
|
v
[14.1 Intake channels]
|
v
[14.2 Intake questions]
|
v
[14.3 Scope statements]
|
v
[14.4 Ownership]
|
v
[Chapter synthesis]
|
v
[Worked example] --> [Exercise EX040]
Learning outcomes and connection
You will be able to (1) run a structured intake that turns a report into a case; (2) state a case scope that is specific and revisable; and (3) assign and transfer ownership without gaps. Chapter 13 decided which events deserve a case; this chapter is about opening that case well.
14.1 Intake channels
Reports reach Fernmoor through detection alerts, the service desk, staff emails to the response mailbox, residents via the contact centre, suppliers and external parties (researchers, other CSIRTs, law enforcement). Each channel needs a route into the same case system and an acknowledgment to the reporter. A public security contact (for example a security.txt file published per RFC 9116) helps external reporters find the right channel. The resident's call about the fake billing email is an example: it arrived through the contact centre, was captured on the intake form and became case FCS-221 in the same system as alerts.
14.2 Intake questions
Who reported, how to reach them, what they observed (exact words), when, which systems or accounts, what they have already done (rebooted? forwarded the email to colleagues?), and whether evidence exists (screenshots, original email with headers). Record observations separately from interpretations. The contact-centre agent in the resident's call asked exactly these questions, recording the sender address, the link domain, the payment of €84 and the two similar calls that day. Because the sender domain was written down exactly, the analyst could see at once that it was not Fernmoor's real domain. The resident's own words were kept separate from the agent's reading of them.
14.3 Scope statements
A scope statement says what the case covers now: affected assets and identities, time window, question to answer. Example: "Determine whether billing-clerk-7 was used by an unauthorized party between 1 and 9 June and what data that account accessed." Scope changes as evidence arrives; record each change, because unrecorded scope creep is how cases become endless, and unrecorded narrowing is how related activity is missed. In FCS-221 the scope widened when the callers' addresses were found in a billing export sent to a print supplier.
14.4 Ownership
Every case has one owner at all times. Ownership transfers explicitly (Chapter 26) with acknowledgment. Tasks inside a case also have owners and due times. Related cases are linked rather than merged until evidence shows the same incident. In FCS-221, each task had its owner: the contact centre for the header copy, Data Platform for the billing-list check and the liaison for the resident warning. The case itself had one owner, the duty analyst, until the severity rose. Linked cases keep related evidence visible without forcing a conclusion early.
14.5 Worked example (synthetic): a resident's call
Fictional. A resident calls the contact centre: she received an email "from Fernmoor Water" asking her to pay an overdue bill through a link; she paid €84. The contact-centre agent uses the intake form: caller details; exact email text and sender address (billing@fernmoor-water.example, not Fernmoor's real domain fernmoor.example); time received; link domain; payment made; whether others have reported (two similar calls today). The duty analyst opens case FCS-221, S3, scope: "Phishing campaign impersonating Fernmoor billing, 10 June onward; identify domains, volume of residents affected, and whether Fernmoor data was used to target them." Tasks: request header copy from the resident (owner: contact centre); check whether recipients match Fernmoor's billing list (owner: Data Platform); prepare a resident warning with communications (owner: liaison). The resident is told to contact her bank; Fernmoor does not handle her payment dispute but records it.
When the Data Platform check showed that all three callers' addresses were in a billing export sent to a print supplier, scope expanded to include the supplier; the change and its reason were recorded and severity raised to S2.
14.6 Common errors and limits
- Recording interpretations as observations ("phishing attack by criminals").
- Vague scope ("investigate the phishing").
- Merging cases before evidence connects them.
- Unacknowledged reporters who stop reporting.
FCS-221 avoided these errors. The intake form recorded what the resident saw, not a judgement about criminals; the scope statement named the impersonated domain, the date and the question to answer; the supplier link was recorded as a scope change with its evidence rather than by merging with another case; and the resident was told what Fernmoor would and would not do. Reporters who hear nothing back rarely report again, so acknowledgment is part of the case.
Exercises — chapter 14
Attempt each exercise before opening the worked results. Every case, organization, person, address and number in an exercise is synthetic unless a cited public source is named.
EX040 — Intake form. Steps: design a ten-field intake form for the contact centre. Rubric: 3 = reporter/contact, observation verbatim, time, systems/accounts, actions taken, evidence available, harm (e.g., payment), other reports, agent, consent to follow-up; 2 = seven; 1 = few; 0 = none.
EX041 — Scope rewrite. Steps: rewrite three vague scopes into specific ones. Rubric: 3 = each has assets/identities, window and question; 2 = two; 1 = one; 0 = none.
EX042 — Scope change record. Steps: write the record for the supplier expansion in the resident's-call worked example. Rubric: 3 = old scope, new scope, triggering evidence, time, who approved, severity change; 2 = missing approval; 1 = vague; 0 = none.
Chapter synthesis
Route every channel into one case system; capture observations verbatim; write specific, revisable scopes and record each change with its reason; and keep one named owner per case and per task.
Continue studying — chapter 14 of 30
← Chapter 13 · Course chapter index · Chapter 15 →
Continue to the next authored lesson.