INVESTIGATE
#001 · IDENTITY & ACCESS
46 Failed Logins. Then One Succeeds.
An employee account generated unusual authentication activity.
- ~3 min
- +100 XP
- Beginner
Daily Incidents
Two to four minutes. Incomplete information. What would you do?
- INVESTIGATE
#002 · ENDPOINT SECURITY
Word Just Launched PowerShell
An EDR alert fired on an unusual process chain.
- ~3 min
- +100 XP
- Beginner → Intermediate
- INVESTIGATE
#003 · EMAIL SECURITY
Your Password Expires Today
An employee reported a suspicious password expiration email.
- ~3 min
- +100 XP
- Beginner
- INVESTIGATE
#004 · IDENTITY & ACCESS
The Impossible Travel Alert
One account, two logins, two distant locations.
- ~4 min
- +100 XP
- Beginner
- INVESTIGATE
#005 · IDENTITY & ACCESS
The Suspicious OAuth App
A user granted a third-party app access to their account.
- ~4 min
- +100 XP
- Beginner → Intermediate
- INVESTIGATE
#006 · ENDPOINT SECURITY
A Scheduled Task Appears
EDR flags a newly created scheduled task after a document opened.
- ~4 min
- +100 XP
- Intermediate
- INVESTIGATE
#007 · THREAT DETECTION
TODAYDNS Every 60 Seconds
A workstation keeps querying the same unusual domain.
- ~4 min
- +100 XP
- Intermediate
- INVESTIGATE
#008 · IDENTITY & ACCESS
A Reporting Add-On Wants Full Mailbox Access
A consent event appears for an app nobody in IT recognises.
- ~4 min
- +100 XP
- Beginner → Intermediate
- INVESTIGATE
#009 · IDENTITY & ACCESS
Two Continents, Eleven Minutes Apart
An impossible travel alert that does not resolve as neatly as the last one.
- ~4 min
- +100 XP
- Intermediate
- INVESTIGATE
#010 · ENDPOINT SECURITY
Encoded PowerShell at 18:40
A spreadsheet closed twenty minutes ago. Something it started did not.
- ~4 min
- +100 XP
- Intermediate
- INVESTIGATE
#011 · CLOUD SECURITY
The Bucket Went Public at 14:06
A configuration change exposed a storage container. Now what does that actually mean?
- ~4 min
- +100 XP
- Intermediate
- INVESTIGATE
#012 · IDENTITY & ACCESS
A New Administrator at 02:13
A privileged account appeared overnight. The hour is the least interesting part.
- ~4 min
- +100 XP
- Intermediate
- INVESTIGATE
#013 · THREAT DETECTION
Every 300 Seconds, Almost Exactly
A host is checking in with the same domain. Software does that too.
- ~4 min
- +100 XP
- Intermediate
- INVESTIGATE
#014 · DIGITAL FORENSICS
The Missing USB Drive
A departing employee, a removable drive, and a lot of assumptions to avoid.
- ~5 min
- +100 XP
- Intermediate