Visual Learning · 21 · Preview

SOC Alert Investigation

Alert triage → enrich → contain → document.

CYNARKS

Teaching simulation · not live capture

SOC Investigation

Lab telemetry only.

1. Logs

Hostlogs
SIEMcorrelate
AnalystSOC
Logs
Endpoint ships failed logins and process events to the SIEM.

Auth failures

  • #1 host → siem Logs Auth failures

Space · ← → · R restart

← All Visual Learning modules