Scenario
This fictional event models a high-pressure response shift where participants receive noisy telemetry, identify true positives, and coordinate containment actions as a structured SOC team.
Flow
- Initial triage with severity scoring and alert suppression decisions.
- Escalation and handoff between detection, response, and reporting roles.
- Root-cause confirmation and prioritized remediation planning.
Deliverables
- Incident summary with confidence levels for each indicator.
- Containment timeline and evidence map.
- Final after-action review with improvements for the next drill.
Resources
Event lab materials can be prepared and distributed through the team CTF workspace: Open Team CTF Website