Browser LabLD-ELA-LAB-003Medium
Browser LabLD-ELA-LAB-003Medium26 min
Correlate on the Timeline
An Elastic Security alert — 'foreign login, j.rai' — lands in your queue. Alone it means little. You pull auth, endpoint and proxy events for that identity onto the Timeline. Reach a defensible verdict: is this an incident, and what is the evidence chain? Do not escalate on one alert, and do not dismiss a real chain because each link looks small.
What you will be able to do
- Correlate multiple sources on a shared key and time in Timeline.
- Read a causal chain across auth, endpoint and proxy.
- Reach a verdict that rules out the benign explanation.
Incident TriageAnalyst ReportingSIEM OperationT1078 — Valid AccountsT1003.001 — LSASS MemoryT1567 — Exfiltration Over Web Service
Sign in to start this lab.
Sign in