Cybersecurity investigations
16 incident cases at simulated companies. Filter by difficulty, then solve one in your browser.
| 1Your First Case NotePractice saving an observation and using it to support a finding. | Easy |
| 2The Unwanted ConnectionSeparate a legitimate payment connection from an unwanted order export. | Medium |
| 3Two Copies of One ProgramFind matching files on two workstations and prove neither copy returns. | Medium |
| 4The Stolen Support LoginTrace a server intrusion to a stolen login and stop the next step. | Medium |
| 5The Forgotten ContractorFollow a login after a contract ended and close the forgotten account. | Easy |
| 6A Permission Too FarRemove unapproved administration access while the manager keeps working. | Easy |
| 7One Unprotected AdminFind the missing MFA protection among two administration accounts. | Easy |
| 8The Rule That Did NothingExplain why a deny rule is ignored and fix it without cutting off support. | Medium |
| 9The Backup Caught in the BlockRestore an approved backup without reopening a leak on the same port. | Medium |
| 10After the RestartCatch an unwanted startup before a stopped program returns. | Medium |
| 11The Program Behind ItFollow a parent process to the launcher that keeps bringing an exporter back. | Medium |
| 12Before You ReconnectPreserve live evidence and safely recover an isolated workstation. | Medium |
| 13The Wrong File Was IsolatedUse file fingerprints to reverse a mistaken quarantine and remove the real threat. | Medium |
| 14A Second Way OutFind an alternate export route that a single-port fix would miss. | Medium |
| 15Stop the Second HopStop a compromised workstation from launching a program on the shop server. | Hard |
| 16The Incident HandoffCombine account, process and file evidence to finish a two-machine incident. | Hard |