INCIDENT EVIDENCE CHECKLIST

[ ] Start time and affected scope
[ ] Exact SMTP responses
[ ] Queue depth and oldest age
[ ] Traffic before/after
[ ] DNS answers and authentication state
[ ] Host resource evidence
[ ] Recent configuration/deployment changes
[ ] Containment action
[ ] Recovery evidence
[ ] Root cause and prevention owner