Your First Investigation

Why it matters

Every case on the Range follows the same loop: launch, read the briefing, investigate in the SIEM, submit as you go, then finish and grade. Learn the loop once and every later run is spent on the investigation, not the interface.

The loop mirrors real post-incident work. You arrive after the attack has happened, with the adversary's traces already in the logs, and you work from telemetry alone. The habits you build here (read coverage before searching, back every claim with evidence, close out deliberately) are the habits a SOC expects.

Core concept

The attack has already happened. The hosts were captured as the attacker left them and their telemetry loaded into the lab. You investigate after the fact, from logs alone, the way an analyst does for an estate they do not administer.

You answer two kinds of question. Detections each cover one stage of the attack: you identify the MITRE ATT&CK technique behind it, then back it with evidence from the telemetry. Objectives are the facts of the case, each with a single answer. The last objective closes the incident and draws on everything before it, so treat it as your incident report in miniature.

A detection earns credit only when the technique is right; evidence alone earns nothing. Give the full ID, including the sub-technique where one exists, and choose it from the search box rather than typing it from memory. Each question allows three tries. An objective uses a try on every answer until it's right; a detection uses one only when a field you filled in is wrong. A right technique with thin evidence earns partial credit and stays open while tries remain, so you can come back with better evidence.

What an accepted answer looks like. Where a question asks for a value, enter it alone, the way the question asks for it. Case and spaces around it don't matter, but nothing close counts: a near miss is wrong. If the box shows a format line, follow it exactly. Times are UTC. Write host names as they appear on the network map. Where a question asks for a short written answer, write it in your own words and cover each thing the question asks for.

Hints cost points. The price is on the button, you confirm before it is spent, and it comes off your final score when you reveal the hint. Spent before a last try, a hint is usually cheaper than a locked question.

The countdown is a hard limit: at zero the range is torn down, whatever state you are in. Finish & grade scores everything you submitted during the run and frees your lab slot. You have one active lab at a time, and a new launch is refused while another run still holds the slot.

Your best run on a case is the one that counts, and the badge on your profile shows its medal: a replay can raise that medal, never lower it. Every graded attempt is numbered, and each run still shows its own score, so a rough first attempt costs nothing.

Your range layout

The session page is where you work for the whole run: a status bar across the top and three columns under it. Keep it open in its own tab from launch until you finish.

123456

Shown in the dark theme

• 1. Status bar. The case name, the Live marker, your run type (Practice, Independent or Assessment) and the countdown. At zero the range is torn down, whatever state you are in. Focus on the range folds the side columns away.
• 2. Left: Case flow. Every step of the case in order: the mission briefing, one step per detection, one per objective, then Finish & grade. Each step shows its state (Done, Partial, Locked or Open). Click a step to jump to its question.
• 3. Middle: the range and the briefing. Open range opens Elastic in a new tab. Under it is the mission briefing: the incident, your role, the environment, who reported it and who you escalate to, Monitoring coverage, what you know going in, and the network map. Click the map to open it full size.
• 4. Right, Tasks (the answer area): your questions. Detections ask for an ATT&CK technique, chosen from the search box, and the evidence fields that back it. Objectives ask for the facts of the case: most take a single value, and some take a short written answer. Every question has three tries, a hint shows its price before you reveal it, and Finish & grade is at the bottom.
• 5. Right, Notebook: Notes, Evidence, Timeline, Hypotheses and a Conclusion. Notes and the Conclusion save as you type; Evidence, Timeline and Hypotheses items save when you click Save, and Finish & grade warns you about any that aren't saved. The Notebook is private to you, is not graded, and appears on your report after grading.
• 6. Right, Assist (Pro Assist only): an AI assistant that answers questions about ATT&CK, the Learn pages and how the platform works. It does not know the case's answers and will not give them. In Independent runs it answers general questions only, and it is off in Assessment runs.

On a phone, a row of buttons at the top shows one area at a time: Range, Tasks, Notebook, Assist and Case flow. Switching never loses what you typed.

How to investigate

1. 1.

   Launch and read the briefing.

   On the case page, choose how to run it (Practice is the default), then click Launch Case: an assessment run has no hints and no assistant until you finish. While the range provisions, read the whole briefing, and note Monitoring coverage and the host names on the network map.

   

   Shown in the dark theme

2. 2.

   Open the lab.

   When the header shows Live, click Open range. Elastic opens in a new tab, on the view the case starts from: for most cases the Security alerts list, for some Discover. Searching is done in Discover. Leave the session page open; the Open range link stays valid while it is.

   12

   Shown in the dark theme

3. 3.

   Widen the time range first.

   Lab telemetry is captured history, not live data, and Discover defaults to a recent window. Set the time picker wide, confirm events appear, then narrow to the incident.

   123

   Shown in the dark theme

4. 4.

   Pick the right data view.

   Each telemetry family has its own fields. Switch data views and read the field list before searching a field that may not exist there.

   host.name : "wks-example-07" and process.parent.name : "invoice_viewer.exe"

5. 5.

   Keep a short timeline.

   Each time you find a relevant event, note its time, host, account and what happened, and keep the list in time order. Write times in UTC. The first and last times you see the activity bound the incident, a gap between two steps tells you what to search for next, and the list becomes your answer to "What happened?" in the notebook's Conclusion. Scoping and Timelines, in Incident Investigation, takes this further.

6. 6.

   Identify, then prove.

   For each detection, settle the technique first. The TTP Catalog shows how each technique appears in this telemetry. Then add the evidence fields, and choose the technique from the search box.

7. 7.

   Submit as you go.

   Submissions are saved on the server and grading scores all of them, so nothing is gained by holding answers back. Spend tries on evidence-backed answers, not guesses.

8. 8.

   Finish and grade.

   When you have submitted what you can, click Finish & grade and confirm. The range is torn down, your slot frees, and you see your score and medal. The run's report also suggests what to work on next.

Annotated examples

Common mistakes

• Mistake: Searching the default time window and concluding the evidence is missing.

  InsteadWiden the time picker first, confirm data appears, then narrow.

• Mistake: Querying a field that does not exist in the data view being searched.

  InsteadRead the field list. A well-formed query on a missing field returns nothing, with no error.

• Mistake: Submitting the parent technique when a sub-technique exists.

  InsteadChoose the exact sub-technique from the search box.

• Mistake: Submitting evidence with no technique.

  InsteadSettle the technique first; evidence alone earns no credit.

• Mistake: Testing guesses against the grader.

  InsteadCheck the telemetry first. Three tries allow an answer and a correction, not trial and error.

• Mistake: Ignoring Monitoring coverage.

  InsteadRe-read it when stuck. It says where evidence can and cannot exist.

• Mistake: Letting the timer run out instead of finishing.

  InsteadUse Finish & grade. Everything submitted is scored and your lab slot frees at once.

• Mistake: Closing the session page mid-run.

  InsteadReopen the run from Home. Submissions are saved and the run resumes where you left it.

Field references

Apply it in a Case

Pick the first case on Analyst Foundations and run the full loop once: read the briefing, widen the time range, back one detection with evidence, then finish and grade.

• CuckooSkills: SIEM searchTelemetry: Windows · Sysmon
• GhostwriterSkills: SIEM searchTelemetry: Windows · Sysmon
• DragnetSkills: SIEM search

References

• Discover · Elastic
• Kibana Query Language · Elastic
• Elastic Common Schema reference · Elastic
• Enterprise techniques · MITRE ATT&CK