An investigation is six things you do. None of them are automated.
Review evidence, form a hypothesis, write your notes, build the timeline, call your verdict — then get scored on all of it, not just whether the answer matches.
Evidence review
Work the alert timeline across identity, endpoint, email, and cloud. Pin what matters — nothing is pre-selected for you.
Hypotheses
Form a theory of what happened, then look for evidence that would prove it wrong. Decoys are seeded on purpose.
Notes
Write your reasoning as you go. Your case notes are what gets graded, alongside your evidence.
Timeline
Assemble the events you've pinned into an ordered narrative — the story of the incident, in your words.
Findings & verdict
Call it: true positive, false positive, or benign. State the required response actions for the case.
Scoring
Graded against a hidden ground truth — see the full rubric.
Your Personal Workspace
A consent-phish granted persistent mail access, which was used to socially engineer an MFA approval and pivot to SRV-DB-07. Credential material was read from memory before privileged queries hit customers.pii. No exfiltration observed — my verdict below.