Warning devices, which simply notify the occurrence of High Power Microwave (HPM) pulses, are not sufficient for High Power Electromagnetic (HPEM) threat analysis. Instead, the determination of characteristic parameters like field strength, pulse width, repetition frequency, and direction of arrival allows the analysis and tracking of HPEM threat signals (forensics). A particular role is played by the radio frequency (RF) information which is newly included in the present work. As part of a comprehensive HPEM protection framework this offers both an alert with some additional information about direction and time for short term fast response and all RF related information for an attack analysis used for long-term counter measures within a protection concept