In the event of a security incident, which of the following should be captured FIRST?