5 Whys Analysis

---

5 Whys analysis is a model for triaging a security event in terms of What, When, Where, Who, Why, and sometimes How an event occurred.

Example

Example

|5 Ws|Answers|
|---|---|
|What?|A malicious file was detected on one of the hosts inside the organization’s network.|
|When?|The file was detected at 13:20 on June 5, 2024.|
|Where?|The file was detected in the directory of the host: “GEORGE PC”.|
|Who?|The file was detected for the user George.|
|Why?|After the investigation, it was found that the file was downloaded from a pirated software-selling website. The investigation with the user revealed that they downloaded the file as they wanted to use a software for free.|