Write the Findings

A useful incident report explains what the evidence supports. Name the affected computer, how the program started, what it tried to do and what you changed.

The practice evidence says demo-browser launched demo-helper. Its file names training-records.csv, and the logs confirm a transfer. Record a specific finding:

seclab answer cause demo-browser

You should see:

Recorded your answer to cause.

This is more useful than writing “someone hacked us.” It gives the next person a fact they can check.

Saved evidence belongs to the moment it was collected. A later record showing the process stopped does not contradict an earlier snapshot showing it running. Include that order in your explanation.