Browser LabLD-SOC1-LAB-009Medium
Browser LabLD-SOC1-LAB-009Medium20 min
Triage the Indicator Set
An EDR alert on WS-114 produced a batch of indicators, and a threat-intel feed match arrived at the same time. Your job is not to block everything — it is to decide which indicator is worth acting on, which is a shared service you must not block, and which single indicator to pivot on to scope the incident. Enrichment and local telemetry are provided.
What you will be able to do
- Classify indicators by real value, not by how alarming they look
- Recognise a shared service that must not be blocked
- Choose the highest-value indicator to pivot on
IOC AnalysisThreat IntelligenceIncident TriageT1566.002 — Phishing: Spearphishing Link
Sign in to start this lab.
Sign in