soc · beginner
Practice identification, containment, eradication, recovery, and lessons learned in a fictional incident.
Login required to start this lab and save your progress.
Section 1 · 1 tasks
Preparation → Identification → Containment → Eradication → Recovery → Lessons learned. Real incidents may move between phases as evidence changes. Preparation includes roles, logging, backups, communication paths, and tested procedures.
Section 2 · 2 tasks
An alert starts investigation; evidence supports validation. Determine affected identities and assets, time window, observed behavior, business impact, and uncertainty before assigning severity. Avoid declaring compromise from a single unverified signal.
Section 3 · 1 tasks
Short-term containment quickly limits harm, for example revoking an active session or isolating an endpoint through an approved process. Long-term containment stabilizes operations while a durable fix is prepared. Preserve evidence and coordinate actions to avoid unnecessary business disruption.
Section 4 · 1 tasks
Eradication removes the cause and persistence: patch vulnerabilities, remove unauthorized artifacts, reset affected credentials through approved processes, and close exposed paths. Recovery restores from trusted state, monitors closely, and validates that normal service and security controls work.
Section 5 · 3 tasks
At 09:10, user sam reports an unexpected sign-in prompt. At 09:12, a successful login from a new region appears. At 09:14, an unfamiliar mailbox rule is created. The user confirms this was not expected. Approved responders can revoke sessions, reset credentials, preserve audit logs, remove the rule, and review other accounts.
Choose safe, reversible, authorized actions; do not delete evidence or attack the source address.
