Alert investigation practice: phishing, identity, endpoint, network
You solve realistic cases for each of the most common alert types, collecting evidence, setting the scope, making a call and writing a case note the next shift will understand.
Level 301 · 16 lessons · 15 practice labs
Lessons
Phishing
- A phishing alert: message, link, recipients
- Who clicked the link: proxy and DNS records
- Removing the message from every mailbox
- Short task: find the users who clicked and entered passwords in a phishing wave
Identity
- The impossible travel alert
- MFA fatigue attacks
- A password spraying case
- Short task: confirm a compromised account and end its sessions
Endpoint
- A malware alert: file, process, spread
- A suspicious PowerShell alert
- A new local admin alert
- Short task: find the root cause of an endpoint alert
Network
- Validating an IDS alert: packet and flow
- An outbound C2 connection alert
- A scanning alert: internal or external
- Capstone: clear a mixed queue of twelve alerts in one shift
Practice labs
- Extract sender, link and recipients from a phishing alert: List the true sender from the headers, the link from the body and everyone who received the same message from the mail logs.
- Find who clicked the link from proxy and DNS records: Search DNS and proxy records for the phishing domain, list the users who clicked and separate the two who submitted the form by their POST requests.
- Close out a phishing wave end to end: For a wave hitting Turnalı Perakende, purge the message from all mailboxes, block the domain, have exposed passwords reset and prove whether suspicious sessions followed.
- Decide whether an impossible travel alert is real: Compare the addresses, device details and VPN exit points of two logons and mark the alert false or true.
- Confirm an MFA fatigue attack from the logs: Put the repeatedly denied and finally approved prompts on a timeline and find where the session was opened from after approval.
- Find the compromised account in a password spraying case and end its sessions: Find the one success among failures spread across many accounts from one source, review what the account did next, revoke its sessions and state the scope.
- Identify the file, process and host in a malware alert: Extract the file path and hash, the process that ran it and the host’s owner from the alert details.
- Decode the encoded command in a suspicious PowerShell alert: Decode the Base64 command without running it, explain what it tries to do and find its origin by examining the parent process.
- Find the root cause of a new local admin alert: Trace back from the process that created the account to the session that started it and the host it came from, and prove the entry point.
- Validate an IDS alert with packet and flow records: Open the capture behind the alert to find the content the signature matched and state from the flow record whether the session completed.
- Tell whether a scanning alert is internal or external: Match the source address to the asset inventory and prove whether the scanner is the authorised vulnerability scanner or an unexpected internal host.
- Trace an outbound C2 alert down to the process on the host: Confirm the regular-interval connection in flow records, find the process opening it and its persistence method in endpoint logs and write your containment recommendation.
- Group the repeated alerts in the queue: In a queue of twelve alerts group those from the same rule and host and state how many distinct jobs remain.
- Order a mixed queue by severity and asset value: Order twelve alerts by severity, asset criticality and age, and explain why the top three come first.
- Clear a queue of twelve alerts in one shift: Record a verdict and evidence for every alert, turn the two real ones into cases and write the shift handover note.
About this course
You solve realistic cases for each of the most common alert types, collecting evidence, setting the scope, making a call and writing a case note the next shift will understand.
What you will learn
- Phishing
- Identity
- Endpoint
- Network
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run on your own Kali Linux desktop in the browser, with the tools ready in their windowed interfaces. Nothing to install; a computer screen is recommended.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.