Browser LabLD-SOC1-CHAL-001Medium
Browser LabLD-SOC1-CHAL-001Medium35 min
Challenge: Three Alerts, One Shift
You have taken over the Nexa Digital queue at 09:00. Three alerts fired overnight and nobody has touched them. The outgoing analyst left no notes. Two of these alerts describe parts of the same activity. One is unrelated. Work out which is which, and decide what the shift lead needs to know.
What you will be able to do
- Decide which evidence sources are relevant before analysing any of them.
- Correlate two alerts that share a host or account but not an alert name.
- Identify the unrelated alert and justify excluding it.
- State a conclusion at the confidence the evidence actually supports.
Incident TriageLog AnalysisNetwork AnalysisIOC AnalysisAnalyst ReportingT1071.001 — Application Layer Protocol: Web ProtocolsT1098 — Account Manipulation
Sign in to start this lab.
Sign in