Case file
Dragnet
A scan alert fires on the administrative bastion. Confirm how the attacker got in, what they went looking for, and how far the exposure really reaches.
- Difficulty
- intermediate
- Estimated time
- About 35 minutes
- Learning Path
- Analyst Foundations
- Plan
- Pro
- Telemetry you will work with
- Linux · Network
- Skills you will use
- SIEM search · Investigation scoping · Evidence and reporting
- ATT&CK tactics
- Discovery · Lateral Movement
The full briefing (your role, what is already known, and who to contact) opens when you launch the case. Sign in to launch it and track your progress.