SIMULATED TRAINING CASE · SOC-004 · Suspicious outbound connection
Simulated outbound network anomaly
A fictional workstation repeatedly attempts connections to a documentation-domain endpoint. The case explores network telemetry and context rather than assuming malicious intent.
SIMULATED · NOT A REAL INCIDENTINITIAL SEVERITY: MEDIUMInvestigation brief
Objective
Determine what the provided evidence supports, what remains unknown, and which next steps are proportionate.
Evidence scope
A deliberately small synthetic sample. There is no endpoint access, full SIEM dataset or independent threat intelligence.
Analyst posture
Validate the signal, seek corroboration, document confidence and avoid treating indicators as identities.
Evidence timeline
| Time (UTC) | Observed training event |
|---|---|
| 09:12:02 | Host 192.0.2.25 initiated TCP connection to 198.51.100.17:443 |
| 09:12:17 | Repeated outbound connection to same destination |
| 09:13:10 | Proxy metadata: host=telemetry.example.invalid, response=blocked |
| 09:14:00 | Analyst note: process attribution not available in sample |
Sample log extract
09:12:02 Host 192.0.2.25 initiated TCP connection to 198.51.100.17:443 09:12:17 Repeated outbound connection to same destination 09:13:10 Proxy metadata: host=telemetry.example.invalid, response=blocked 09:14:00 Analyst note: process attribution not available in sample
Findings and limitations
Supported assessment
Repeated connections alone are not proof of command-and-control. Host process data and authorised software context are missing.
Recommended next steps
Correlate proxy, DNS and endpoint process logs; verify business justification; isolate only if further evidence supports containment.
Learning outcomes
This exercise demonstrates a repeatable SOC workflow: validate the detection, construct a timeline, identify missing evidence, assess risk and recommend proportionate actions. The narrative is a worked training example, not a report from an actual incident.