ForenShield Lab · SOC Lab
Your shift is starting: the alert queue is waiting
Alerts are coming in and your shift time is limited. Investigate, correlate Windows events, dismiss false positives and escalate what needs it.
- ≈ 15 min
- No account
- Fictional data
Outline
What you will do
Triage the queue
Choose what to handle first: not all alerts are equal.
Investigate
Each check costs shift time: be selective.
Correlate
Several isolated alerts can tell the story of a single attack.
Decide
False positive, legitimate activity or incident: close or escalate.
Key takeaways
What you will learn
- Prioritize an alert queue
- Correlate Windows Event IDs with each other
- Tell false positives from real incidents
- Know when to escalate, and with what evidence
On real data
Then move on to the real tools
The simulation is for practice. For your own data, use the tools designed for that purpose.
Frequently asked questions
Before you start
Are the alerts real?
No. The alerts, users and logs are made up and no real data is used. Shift time is simulated: you face no real countdown.
How does the score assess my reflexes?
It takes into account the accuracy of your classifications, your escalation decisions, the handling order and the shift time used.
Does this simulation prepare me for a SOC job?
It gives an idea of the approach and helps review common Windows events. It replaces neither training nor experience gained on real monitoring tools.