Every lab, expanded.
The same three labs set out in full: the scenario constructed, the telemetry available, the tooling used, and the question each was built to answer.
Authentication log analysis
Simulates a credential-based brute-force attempt by ingesting Windows Security Event Logs into Splunk, building SPL detection queries, and producing a structured analyst response workflow with documented triage decisions and a measurable outcome.
- Scenario
- Repeated failed logons suggest credential-attack behavior against Windows accounts.
- Telemetry
- Windows Security logs reviewed and normalized inside Splunk.
- Evidence
- 80+ failed logon attempts identified within a defined time window.
- Workflow
- Ingest → detect → triage → respond, each step producing an artefact the next depends on.
Phishing response walkthrough
Models a phishing-to-malware chain from the initial user report through host-based indicator analysis, containment decisions, and structured incident documentation aligned with incident response practice.
- Scenario
- A user reports a suspicious email, then the host starts behaving unusually.
- Telemetry
- Host process review, Windows Event Logs, endpoint investigation notes.
- Evidence goal
- A timeline linking delivery, execution, persistence and containment.
- Workflow
- Report → analyze → contain → report out.
Access control workflows
Documents operational identity scenarios: role-based access review, MFA enforcement, account lifecycle governance, privileged access handling, and least-privilege enforcement in day-to-day support work.
- Scenario
- An access or recovery request needs validating before anyone approves it.
- Telemetry
- Directory attributes, group membership, MFA state and request context.
- Evidence goal
- Least privilege enforced and approvals that hold up under pressure.
- Workflow
- Request → verify → control → record.