How Our Ranges Work

Why it matters

A range is not a puzzle built to be solved. It is a compromised network with the attack's traces sitting in ordinary logs among weeks of normal activity. Knowing that changes how you search: you are reconstructing events, not looking for a planted flag.

Knowing which evidence families a case gives you, and what each one can and cannot see, saves hours. Half of investigating well is knowing where an answer could be before you look for it.

What analysts see

Every case gives you three things.

• Tags on the case card naming its evidence families. They are your first clue to where the evidence lives.
• A briefing with Monitoring Coverage: which sources exist in this lab, and which do not.
• Elastic Security, holding all of that telemetry in one place, with one data view per kind of record.

Every record in a case comes from activity that really ran on the network.

Core concept

Incident response, not capture the flag. A capture-the-flag challenge is designed to be solved. Real incident response hands you a network after the fact and asks what happened. Each case works that way: the attack has already run, its traces landed in the logs as they would on a real network, and you reconstruct it from evidence that was never organized for your convenience.

Eight evidence families. Windows: the built-in event logs for logons, account and privilege changes, and scheduled tasks. Sysmon: process creation with full command lines and parent processes, plus registry changes. Linux: the kernel audit framework, for process execution and file access. Network: Zeek's connection, DNS and protocol logs, with flow summaries for volume and pattern. Suricata: signature alerts raised as traffic matches known-bad patterns. Web logs: web server, application and database audit records. Mail: the mail server's transport records, plus mailbox access where the range runs a mailbox server. Proxy: the proxy's own decisions about outbound traffic.

Each family sees part of the picture. A network record knows two addresses but not which program spoke. An endpoint record knows the program but not what the far end did. Most findings come from joining two families on the same host and time.

The telemetry is the kind real tools are built on. Commercial endpoint and network products have their own sensors, but they collect the same classes of signal: process lineage, authentication and privilege events, network metadata. Some, such as Corelight, are built directly on Zeek. Learning to read the signal itself transfers to whichever product you use later. Learning one console does not.

One real environment, with real noise. Every case is a slice of one continuously running network: domain controllers, servers and workstations with ordinary logons, file access and mail flow. Easier cases focus on one host. Harder ones follow an intrusion across several. The noise is part of the test, because finding the signal among normal activity is the real skill.

Annotated examples

How to investigate

1. 1.

   Read the case card's tags.

   List the families you have before you open the lab.

2. 2.

   Read Monitoring Coverage.

   Note which sources exist and which do not. Evidence cannot be in a source the lab does not have.

3. 3.

   Open each data view once.

   Widen the time range and read the field list, so you know what each family records.

4. 4.

   Find a first anchor.

   Pick one record that matters and note its host, account and time.

5. 5.

   Cross to another family.

   Search the same host and time window in a second family to fill in what the first could not see.

6. 6.

   Build the timeline.

   Order what you found by time, and note which family each step came from.

Common mistakes

• Mistake: Treating the case as a puzzle with one planted clue.

  InsteadReconstruct the sequence of events from the evidence as a whole.

• Mistake: Searching for a field the data view does not have.

  InsteadRead each data view's field list first.

• Mistake: Concluding something did not happen because one family shows nothing.

  InsteadCheck whether that family could see it at all, then try another.

• Mistake: Ignoring Monitoring Coverage.

  InsteadUse it to rule sources in and out before you search.

• Mistake: Reading every normal event as suspicious.

  InsteadLearn what ordinary activity looks like, then look for what breaks the pattern.

• Mistake: Staying inside one family.

  InsteadJoin families on host and time.

Field references

Apply it in a Case

On your next case, before your first search, write down the case's evidence families and one thing each could show you. Then find one finding that needs two of them.

• DragnetSkills: SIEM searchTelemetry: Network
• CuckooSkills: SIEM searchTelemetry: Sysmon
• GhostwriterSkills: SIEM searchTelemetry: Sysmon

References

• Elastic Security documentation · Elastic
• Sysmon · Microsoft Sysinternals
• Zeek documentation · The Zeek Project
• Suricata user guide · OISF