312-39V2: Certified SOC Analyst v2

A multinational financial institution detects unusual network activity during a routine security audit. The SOC (Security Operations Center) identifies multiple failed login attempts, followed by a successful access attempt using an administrator's credentials from an unrecognized IP address. Soon afterward, sensitive customer records are accessed without authorization. The company suspects a possible security breach and brings in the forensic investigation team to analyze the incident. During evidence collection, the forensic team creates a detailed record tracking every individual who handled the evidence, its storage location, and the timestamps of transfers. What is this process called?