Suspected lateral movement
Trigger: unusual authentication after an endpoint alert.
Evidence: EVTX, EDR export, firewall logs, browser artifacts, optional memory.
What CaseScope does: correlate authentication, remote access, process execution, and network connections under one case timezone.
What the analyst produces: a documented sequence of users, systems, supporting events, and findings.
What CaseScope does not claim: automatic proof of lateral movement.