Case studies: investigating incidents with data
You investigate six realistic incident cases using data sets alone: frame the question, query the evidence, build a timeline and report your findings.
Level 301 · 15 lessons · 12 practice labs
Lessons
Method
- The case method: question, hypothesis, evidence
- Testing and ruling out hypotheses
- Preserving data evidence: copies, hashes, notes
- Quick task: an investigation plan for a case
Cases
- Case 1: a leaving employee's bulk download
- Case 2: credential stuffing on a customer portal
- Case 3: reconnaissance traces before ransomware
- Case 4: a fraud pattern in payment records
- Case 5: use of a leaked API key
- Case 6: analysing denial-of-service traffic
- Quick task: common indicators across six cases
Reporting
- Timeline and findings report
- Lessons learned: which data was missing
- Briefing management on a case
- Capstone: solve an unknown case from start to finish
Practice labs
- Match hypotheses to evidence: Match five given hypotheses in a data-leak case to the data source that would confirm or refute each one.
- Refute a hypothesis with data: Test the hypothesis that the attack came from outside against VPN and internal network logs and show the evidence lines that refute it.
- Preserve the evidence copy: Take a read-only copy of the log files to be examined and record their hashes and every action taken in an evidence note.
- Bulk downloads after hours: Find the account that downloaded far above its usual volume after hours in file-server logs and the folders it took.
- The real user of a shared account: Tie a suspicious action made with a shared service account to a real person using source IP, device and badge records.
- The pattern in fake invoices: Link invoices split just under the approval threshold to newly opened supplier accounts in payment records and extract the suspicious chain.
- Login attempts with leaked passwords: Find the sources trying many different accounts one at a time in customer-portal logs and list the logins that succeeded.
- Tracing a stolen API key: Establish an API key's normal usage pattern and identify the unauthorised use from other countries and endpoints and the data it reached.
- Reconnaissance before ransomware: Find traces of network scanning, backup deletion and mass privilege attempts in the three days before encryption and order the attacker's progress.
- Put findings on a timeline: Put ten given evidence lines in time order and prepare a timeline with each one's source and confidence level.
- Document the missing data: Write the three questions a case could not answer, the logs that were needed but never collected and a recommendation to lessons.md.
- A five-minute management briefing: Write a one-page management summary from technical case notes under what happened, the impact, what was done and what is needed.
About this course
You investigate six realistic incident cases using data sets alone: frame the question, query the evidence, build a timeline and report your findings.
What you will learn
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.