> For the complete documentation index, see [llms.txt](https://docs.fourclover.org/v0.1/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.fourclover.org/v0.1/use-cases/incident-responder.md).

# Incident Responder

**Scenario**

An incident responder needs to detect unauthorized changes to system files during a potential breach.

**Command**

Use Four Clover to spot unexpected file changes indicating potential intrusion attempts.

**Example Command**

```bash
fourclover snapshot mytargetdir -hashes sha256 -name "Intrusion Detection"
```

**Outcome**

Detected changes provide early warnings for intrusion attempts, enabling timely response and mitigation.