Don't guess the attack.
Investigate it.
Pick a scenario, watch the attack unfold, open the evidence, hunt across network + endpoint + identity data, then make the triage call. Every case is simulated for learning.
Example: phishing attachment, malicious download, or exposed service response.
DNS/HTTP(S)/SMTP or another protocol carries the content toward the victim.
The endpoint receives or creates a file. EDR can record the path, hash, user and timestamp.
A user action or service launches a process. The process tree shows the parent → child relationship.
The process creates DNS/network activity to an external destination. Correlate process + IP + time.
NDR/EDR/identity signals combine into an investigation story for the analyst.
phishing email → HTTPS download → C:\Users\Alex\Downloads\invoice.exe → explorer.exe → invoice.exe → C2: 198.51.100.20:443. The important question is not just “what IP connected?” — it is what process made the connection, how did that process start, and how did the file arrive?A small unit of network communication. Follow the source, destination, protocol and port before thinking about the security meaning.
PC-01 → Switch → Firewall → Service • TCP/443 • expected application traffic.
A network connection becomes more meaningful when you can correlate it with the process that created it.
LAN → gateway → firewall → destination. Protocol and port describe how the service communicates.
North-South: Internet ↔ internal/DMZ. East-West: internal host ↔ internal host.
User: alex • Device: PC-01 • Login: normal • MFA: not required in this simulation baseline.
A valid account does not automatically make every access request legitimate. Correlate user, device, time and source.
Connect this lab to GRC
Use the fictional alerts, endpoint events and network evidence from this lab to practice describing a risk, choosing a safeguard, assigning an owner and recording evidence. SIEM, NDR and EDR signals help explain what happened; GRC makes the response measurable and accountable.