Browser LabLD-SOC1-LAB-013Medium
Browser LabLD-SOC1-LAB-013Medium22 min
The Integrated Shift: One Incident, Every Pillar
It is your shift. A single alert — a failed-login spike — is at the top of the queue, and it is about to become a full incident. Walk it end to end: read the SIEM aggregation to find the host, follow the network to what it is talking to, assess the destination, and decide the response. Each step is a different question answered by a different source; hold the thread from the first alert to the final decision.
What you will be able to do
- Move an investigation across SIEM, network and IOC sources without losing the thread
- Correlate independent sources into one confident finding
- Reach an evidence-preserving response decision
Incident TriageLog AnalysisNetwork AnalysisIOC AnalysisAnalyst ReportingT1110.003 — Brute Force: Password SprayingT1071.001 — Application Layer Protocol: Web Protocols
Sign in to start this lab.
Sign in