SECURITY OPERATIONS · EVIDENCE FIRST
Three documented training cases designed to demonstrate triage, scope, uncertainty and clear incident notes.
CASE 003 · SIMULATED
An external documentation-range source makes repeated SSH authentication attempts against a fictional Linux host. The available evidence supports attempted password guessing, not confirmed compromise.
MEDIUM initial severity
Read case study →CASE 004 · SIMULATED
A fictional workstation repeatedly attempts connections to a documentation-domain endpoint. The case explores network telemetry and context rather than assuming malicious intent.
MEDIUM initial severity
Read case study →CASE 005 · SIMULATED
A fictional email asks the recipient to verify an account using an unfamiliar URL. The exercise demonstrates safe triage and evidence collection.
LOW initial severity
Read case study →Use the offline interactive lab to review synthetic SSH events, adjust your assessment and generate a text report locally in your browser.
Open SOC triage lab ↗