Investigation workflow
- Validate: confirm the rule predicate, timestamp interpretation, source and completeness.
- Scope: establish relevant accounts, assets and a bounded authorized time range.
- Corroborate: seek independent identity, endpoint or network telemetry.
- Challenge: test benign explanations and contradictory evidence.
- Assess: document provisional severity, known impact and uncertainty.
- Handoff: cite evidence and recommend only permitted next actions.
Three worked training cases
Authentication — potential brute force
Six fabricated login failures followed by a success satisfy the threshold. MFA and real session context remain unobserved, so the case is not a confirmed incident. Read simulated investigation.
Windows execution — technique-like command lines
Fabricated Windows 4688 entries match an encoded PowerShell switch and certutil URL-cache flags. Both need context before malicious intent could be inferred. Read process case study.
Network traffic — DNS/HTTP review
A fabricated PCAP contains failed DNS resolutions and HTTP POST behavior; neither confirms command-and-control or exfiltration. Read the network case study.
Source-backed supporting artifacts
- Triage playbook — steps, evidence boundaries and example escalation levels.
- Evidence matrix — rule coverage, test sources and what remains unverified.
- Handoff template — a reusable record of observations and authorized next steps.
- Project résumé bullets — conservative language supported by published artifacts.
Limits
These worked cases use controlled training data. Their purpose is to demonstrate investigation method and documentation within the stated lab scope.
No private CR/RAI source, credentials, or genuine organization data are disclosed. Real incident handling and any active response require explicit permission.