Evidence preservation
Evidence preservation is the handling and retention of incident data and its metadata so its integrity, origin, and availability can be maintained for later examination.
Keep the context with the record
An exported event is easier to interpret when you know where it came from, when it was collected, and how it was exported. Keep its original timestamps too. NIST recommends protecting incident records from unauthorized access and following the organization’s preservation procedures and retention policies.
Follow the organization’s evidence-handling procedures when deciding whether formal chain-of-custody records are needed.
Work from copies
After a suspected help-desk impersonation, collect the relevant ticket, account changes, and sign-in records. Note the tenant, time period, export method, collector, and collection time. Keep the acquired files separate from the spreadsheet or other working files you use to build the timeline.
Record integrity checks when collecting and transferring the files. Chain of custody explains how those checks fit into the handling history.
Collect before the records disappear
Check which sources may expire or rotate, and arrange authorized collection promptly. Entra activity-report retention depends on the tenant’s licensing and export setup; don’t assume the history will still be there later.
Limit access, document who handles the files, and keep the metadata needed to read them correctly. Record containment changes and their times so investigators can distinguish them from attacker activity. Check that the saved files still open.