Evaluate what happens during the incident.

Look at whether identity activity, processes, devices, network behavior and data access can be followed as parts of the same incident rather than separate alerts.

Examine whether analysts can understand where the activity began, how it moved, which systems were affected and what remains uncertain.

Review how actions are authorized, how local protection behaves when connectivity is lost and whether every response remains accountable.

Run an authorized assessment and inspect what the platform observed, correlated, reconstructed and contained under conditions relevant to your environment.