Visual Learning · 21 · Preview
SOC Alert Investigation
Alert triage → enrich → contain → document.
CYNARKS|Cyber Flow Explorer
Teaching simulation · not live capture
SOC Investigation
Lab telemetry only.
1. Logs
Hostlogs
SIEMcorrelate
AnalystSOC
Logs
Endpoint ships failed logins and process events to the SIEM.
Auth failures
- #1 host → siem Logs Auth failures
Space · ← → · R restart