Labs written up like case files.
Each lab reconstructs a situation that cannot be rehearsed on live systems, then records the telemetry available, the decisions taken, and what the evidence showed.
A simulated brute-force attempt against Windows accounts, worked from raw event data to a written response. Windows Security logs ingested into Splunk, SPL queries grouping failed logons by source host and account, thresholds tuned so the alert survives contact with real noise, and analyst notes written for reuse.
Splunk · SPL · Windows Security logs · Event ID 4625A phishing intrusion followed from the user report through host indicator analysis, process review, log evidence, containment decisions, and an incident summary written for readers who were not involved in the investigation.
Sysinternals · Windows Event Logs · containmentOperational access-control scenarios: MFA enforcement, least-privilege review, account lifecycle decisions, and recovery requests handled in a way that stays consistent when the person asking is senior and in a hurry.
Active Directory · MFA · least privilegeThe standard each lab is held to.
Each lab answers the same four questions: what happened, what evidence proves it, how should someone respond, and how does this become repeatable? Anything that cannot answer all four stays marked in progress rather than dressed up as finished.
Scenario
Build a controlled situation with enough realism to produce meaningful telemetry, and state the assumptions up front.
Detection
Write the query logic, validate the signal, and document where the false-positive boundary actually sits.
Triage
Turn raw events into findings with clear severity and scope, recording the decision points along the way.
Response
Package the workflow so the same pattern can be repeated and improved by someone else.