Browser LabLD-SOC1-LAB-007Medium
Browser LabLD-SOC1-LAB-007Medium20 min
Three Clocks, One Incident
An intrusion is confirmed on WS-090 and your job is the timeline. The catch: the domain controller logs in UTC, the workstation logs in UTC+3, and the cloud mail service logs in UTC-5. Get the order wrong and the report will claim the response happened before the attack.
What you will be able to do
- Normalise timestamps across three time zones
- Establish the true first event
- Measure dwell time from evidence
Log AnalysisIncident TriageAnalyst ReportingWindows SecurityT1566.001 — Spearphishing Attachment
Sign in to start this lab.
Sign in