ForenShield Lab · Incident Lab
Handle a cyberattack from first alert to final report
Monday, 8:47 am: an accountant reports unreadable files. You are on call at a fictional carrier, and each of your decisions changes what happens next.
- ≈ 15 min
- No account
- Fictional data
Outline
What you will do
Identify the intrusion vector
Review the available evidence and decide how the attacker got in.
Analyze the first alerts
Separate what belongs to the attack from the usual noise.
Choose your containment
You only have time for four actions: your choice decides the extent of the damage.
Rebuild the timeline
Put the facts back in order to understand the sequence.
Notify the right people
Choose who to alert, and within what time frame.
Key takeaways
What you will learn
- Reason from evidence rather than gut feeling
- Contain without destroying useful traces
- Map an incident to MITRE ATT&CK techniques
- Know the GDPR notification deadline
On real data
Then move on to the real tools
The simulation is for practice. For your own data, use the tools designed for that purpose.
Frequently asked questions
Before you start
Does this simulation analyze my system?
No. The company, machines, logs and domains are made up. Nothing is read from your machine and no data leaves your browser. For a real investigation, use ForenShield Client or call on a service provider.
How is the score calculated?
Each stage earns points based on how sound your decisions are, for a total of 100. The report details the result by stage and offers recommendations tied to your choices.
Do I need technical knowledge?
Basic notions are enough: every answer is explained. The simulation suits a team exercise or a refresher, but it does not replace a supervised crisis exercise.