Browser LabLD-SPL-LAB-004Medium
Browser LabLD-SPL-LAB-004Medium26 min
Ten Minutes to a Verdict
A single alert — 'foreign login, j.rai' — lands in your queue. On its own it means little. You pull auth, endpoint and proxy events for that user into one timeline. Your job is a defensible verdict: is this an incident, and if so, what is the evidence chain? Do not escalate on one scary line, and do not dismiss a real chain because each link looks small.
What you will be able to do
- Correlate multiple sources on a shared key and time.
- Read a causal chain across auth, endpoint and proxy.
- Reach a verdict that rules out the benign explanation.
Incident TriageAnalyst ReportingSIEM OperationT1078 — Valid AccountsT1003.001 — LSASS MemoryT1567 — Exfiltration Over Web Service
Sign in to start this lab.
Sign in