CYBERESCUDO / INVESTIGATION DESK

Connect the evidence.
Keep the context.

One email, several observations, one investigation. Build a case with explicit sources and keep facts separate from your hypotheses.

Practice only: do not enter real, personal or secret data. There is no autosave. Reloading or changing language may lose your work: download JSON to reopen it. Files are not encrypted; review them before sharing.

Case controls

01 Investigation brief

02 Sources and evidence

Select email, identity or test bench samples. Bench records are independent context: they do not prove a connection to this incident.

03 Timeline

UTC when the source supports it. Records without a reliable time appear last. Proximity in time does not prove causation.

    Add analyst event

    Empty or ambiguous values remain unknown; the computer clock is not used.

    04 Indicators with context

    Candidates extracted from text, without reputation lookups or opening addresses. Names such as powershell.exe may be files, not observed domains. An indicator is not a verdict.

    05 Notes and hypotheses

    Multiple selection: Ctrl/Cmd or Shift. The note keeps its citations when you filter the view.

    Record why an observation supports, questions or contextualizes another. These links express your hypothesis; they do not prove causation.

    What this case does not prove

      Confirm the change