Project Obsidian: Incident Response - Scoping the Incident from the Ground Up

In this instructional session from Project Obsidian at the DEF CON 30 Blue Team Village, instructors break down the foundational principles of incident scoping during digital forensics and incident response (DFIR) operations. The presentation opens at 06:00 by defining an incident scope—distinguishing confirmed forensic facts from assumptions and evaluating initial organizational impact across critical business systems.

At 12:00, the speaker emphasizes the necessity of centralizing investigative findings into a shared evidence repository, ensuring all analysts work from a consistent timeline. Guidance on conducting non-adversarial witness and employee interviews follows at 18:00, showing how open-ended questioning uncovers initial infection vectors without inducing defensiveness. At 24:00, the session explores calculating adversary dwell time, contrasting historical industry averages with modern fast-moving ransomware threats.

The talk concludes at 30:00 by illustrating how to structure formal, executive-ready incident reports that clearly communicate containment boundaries and remediation priorities. At 36:00, the speaker addresses the emotional and mental strain of prolonged incident handling, providing practical advice on maintaining investigative rigor and managing team fatigue during high-stress corporate intrusions. (AI summary — Gemini Flash)