Lab 15 • Defensive Cyber Operations
Defensive SOC Case Lab & Incident Containment
Triage 4 synthetic alerts. Link evidence before classifying critical threats. All URLs shown are inert text — no simulation button ever sends a real network request.
Chronological Event View
08:14 UTC • cfo@company.comunreviewed
Login from Tokyo IP. CFO travel itinerary is on file with IT.
08:19 UTC • admin_svcunreviewed
42 consecutive failed SSH attempts, then successful sudo escalation from an unrecognized subnet.
08:24 UTC • sales_rep1@company.comunreviewed
Clicked a link in an email claiming "Urgent Wire Receipt Update".
Inert text (not a link): hxxp://pay-internal-portal[.]top08:31 UTC • finance_ops@company.comunreviewed
"Q3 Vendor Invoice" email from billing@vendr-support.co requesting a bank-detail update.
Fictional Account Map — Alerts per Account
Classification Breakdown
4Total Alerts
Analyst Workbench: alt-101
Link at least one evidence tag to unlock the "critical threat" classification.
1. Validity
Inputs Supported
All configuration parameters are valid.
2. Correctness
Objective: Demonstrated
Ready for verification run
3. Constraints
Within Limits
Budget, SLA, and capacity limits respected.
4. Trade-offs
Analysis
Inspect scenario parameters to evaluate trade-offs.