← Back to Academy course

Practical Lab 01: SOC Alert Triage

Free public beta · 15–25 minutes · guest practice or signed-in graded progress

Checking Academy sign-in…

You're a junior SOC analyst at a fictional company, BluePeak Services. An alert reports unusual authentication activity followed by an email setting change. Investigate the evidence, choose a priority and recommend the next authorized action.

Learning objective

Correlate multiple log events using account, source address and timestamps; distinguish suspicious patterns from proven compromise; and select a responsible response.

All names, events and IPs are fictional. IP addresses use documentation-only ranges. No commands, network scans, live accounts or personal data are involved.

Step 1 — Examine the evidence

Read the events in chronological order. Notice the repeated failures, what happens next and whether an account configuration changes.

EventTimeSourceAccountSource IPObservation

These events are simulated for learning and must not be treated as actual evidence of a real incident.

Step 2 — Submit your investigation

1. Which account needs investigation?
2. Which events support your conclusion?

Select each key event in the suspicious sequence.

3. What priority should this alert receive?
4. What is the safest next step?

Loading synthetic dataset…

Step 3 — Document your finding

After reviewing the feedback, write a short incident note in your own words: what happened, which event IDs support your finding, what information is still missing and who you would escalate to. Do not claim an incident is confirmed without additional verification.

Signed-in learners receive a recorded formative grade and can track their best score and attempts in My Dashboard. Guest attempts receive local practice feedback only. Scores do not affect Fundamentals lesson completion or course certificates, and this static training case is not a proctored qualification.