Section 1 · 1 tasks
Investigation intake
Investigation intake
This section uses a fictional, authorized training scenario. Study the concepts, compare the example evidence, and record what is observed versus what is inferred.
Practical guidance
Apply the incident response and correlation concepts to a bounded exercise. Do not contact real systems, use real credentials, or execute destructive actions.