SOC Investigation

Intermediate90 ptsSOCSIEM

Objective

Logs → SIEM correlation → alert → analyst response.

Cyber Flow Explorer · 4 steps · Network / Sequence / Packet / Code.

Isolated browser lab. Practice here first — no live targets. Optional deeper practice lives in the Academy library after you finish this room.

Answer panel

Challenge workspace

Complete the room tasks, then submit here to mark the room done.

CYNARKS|Cyber Flow Explorer

Teaching simulation · not live capture

SOC Investigation

Lab telemetry only.

1. Logs

Hostlogs

SIEMcorrelate

AnalystSOC

Logs

Endpoint ships failed logins and process events to the SIEM.

Auth failures

Space · ← → · R restart

Hint

Stop the bleed, then learn.

Why this is correct

Detect → alert → investigate → contain → lessons learned.