Preview build: sign-in and grading run on the server. MFA is not enabled, and storage is in server memory so it does not survive a restart.

Sign in Create account

Browser LabLD-SOC1-LAB-002Easy

Browser LabLD-SOC1-LAB-002Easy20 min

The 03:00 Sweep

An alert fires at Nexa Digital: 'Host contacting unusually large number of internal systems'. The source is 10.20.7.9, which reached 214 internal hosts in eleven minutes. The pattern resembles internal reconnaissance. Determine whether it is.

What you will be able to do

Establish whether the behaviour has a legitimate explanation.
Support a benign verdict with evidence, not assumption.

Incident TriageLog AnalysisDetection Engineering

Sign in to start this lab.