Case file
Low Tide
Meridian's threat intelligence team reports an intrusion set that targets regional distribution hubs, and asks the SOC to hunt for it. From that report, establish whether Meridian has an intrusion at all, and if it does, how far it reached.
- Difficulty
- advanced
- Estimated time
- About 240 minutes. 8-hour session limit.
- Learning Path
- Specializations
- Plan
- Pro
- Telemetry you will work with
- Windows · Sysmon · Linux · Suricata · Network
- Skills you will use
- Alert triage · SIEM search · Investigation scoping · Timeline reconstruction
The full briefing (your role, what is already known, and who to contact) opens when you launch the case. Sign in to launch it and track your progress. Create a free account