Incident worksheet

Case reference:
Case owner and backup:
Legitimate organization and domain:
Observed domain and URLs:
First observed (time zone):
How it was reported:
Confirmed facts:
Unverified assumptions:
People, accounts or payments potentially affected:
Evidence location:
Containment actions and owners:
Provider reports and ticket references:
Communications sent:
Outstanding questions:
Next review time:
Closure decision and reason:

Source: DNSTwister — https://dnstwister.com/resources/