Case management
Incidents
Alerts that belong to the same intrusion are merged into an incident with an owner, SLA and audit trail.
Open
3
Critical
2
SLA breached
1
Mean time to contain
2h 14m
Phishing-led intrusion with credential dumping on WS-FIN-014
A macro-enabled invoice attachment delivered a PowerShell loader to a finance workstation. The loader established C2, dumped LSASS, and moved laterally to the SQL server via admin shares.
Password spray followed by mailbox rule abuse
A spray campaign from hosting infrastructure compromised one account without MFA. The actor created a hiding inbox rule consistent with business email compromise preparation.
Ransomware staging detected on SRV-FILE-03
Canary files were encrypted and shadow copies deleted on the primary file server using a compromised backup service account.
Learn this capability
Hands-on labs that build the technique behind this workspace. Skills transfer to any mainstream SIEM.
Intermediate · Simulation · 45 min
Building the phishing intrusion timeline
INC-1041 — phishing-led intrusion with credential dumping on WS-FIN-014 — is open and assigned. The case needs a timeline that a manager, a customer and a court could all read.
Intermediate · Theory · 14 min
Escalation and handover quality
Your shift ends in fifteen minutes and INC-1041 is still open. Whatever you fail to write down, the next analyst will have to rediscover.
Advanced · Theory · 18 min
The incident response lifecycle
INC-1041 is confirmed: phishing led to encoded PowerShell and credential access on a finance workstation. The case is now yours as incident responder.