Incident responders rarely get to watch an attack from the beginning. More often, security tooling arrives after the damage ...