Lab 15 Enterprise SOC Analyst Capstone

End-to-End Security Investigation

Welcome to the final SOC Analyst lab.

Everything in the previous fourteen labs has prepared you for this mission.

This time, you are not being told:

which log source contains the answer
whether the alert is a true positive
whether one or multiple systems are affected
whether the identity activity is related
whether the suspicious domain matters
whether containment is required
what the final severity should be

You must determine those things from the evidence.

Mission Goal: Conduct a complete enterprise SOC investigation from initial alert through triage, multi-source investigation, correlation, timeline reconstruction, incident scoping, containment recommendations, escalation, and final case reporting.

This capstone evaluates whether you can work like a SOC analyst rather than simply follow individual technical exercises.

Mission Information

Item	Details
Difficulty	Advanced
Estimated Time	3–4 hours
Primary Skill	End-to-End SOC Investigation
Secondary Skill	Incident Analysis & Response
Environment	GoHackersCloud Enterprise SOC Lab
Investigation Type	Multi-Source Security Incident
Starting Point	SIEM Security Alert
Expected Output	Complete SOC Investigation Package
Safety Level	Authorized Training Evidence Only

Capstone Methodology

Use the complete SOC methodology:

Alert → Validate → Investigate → Correlate → Scope → Contain → Escalate → Report

Expanded:

Security Alert
      │
      ▼
Alert Triage
      │
      ▼
Validate Telemetry
      │
      ▼
Establish Context
      │
      ▼
Investigate Host / User
      │
      ▼
Investigate Email / Endpoint
      │
      ▼
Investigate DNS / Web
      │
      ▼
Investigate Network
      │
      ▼
Search SIEM
      │
      ▼
Enrich Indicators
      │
      ▼
Correlate Evidence
      │
      ▼
Reconstruct Timeline
      │
      ▼
Determine Scope
      │
      ▼
Assess Impact
      │
      ▼
Determine Severity + Confidence
      │
      ▼
Contain / Escalate
      │
      ▼
Final SOC Report

The core principle remains:

Methodology first. Tools second. Evidence always.

Learning Objectives

By completing this capstone, you will demonstrate your ability to:

triage an enterprise security alert
determine alert priority
establish asset and identity context
identify appropriate telemetry sources
investigate Windows security events
investigate authentication anomalies
investigate suspicious email activity
investigate endpoint alerts
analyze DNS activity
analyze proxy/web telemetry
analyze network security events
perform SIEM searches and pivots
enrich indicators using threat intelligence
distinguish enrichment from local evidence
correlate multi-source telemetry
normalize timestamps
reconstruct an incident timeline
establish first-seen and last-seen activity
distinguish exposure from compromise
determine affected hosts and identities
assess security impact
identify telemetry gaps
determine severity
determine analyst confidence
recommend appropriate containment
determine escalation requirements
preserve investigation evidence
prepare SOC-to-IR handoff
produce a professional final SOC report

The Enterprise Scenario

You are working as a SOC analyst for the fictional organization:

NovaCore Financial Services

The organization operates:

Internet
   │
   ▼
Email Security Gateway
   │
   ▼
Corporate Users
   │
   ├── Finance
   ├── Human Resources
   └── Operations
   │
   ▼
Corporate Network
   │
   ├── Windows Workstations
   ├── Linux Servers
   ├── Internal Applications
   └── Identity Services

Security telemetry is centralized into the organization’s SIEM.

Available telemetry includes:

SIEM
 │
 ├── Email Gateway
 ├── Identity / Authentication
 ├── Windows Security
 ├── Endpoint / EDR
 ├── DNS
 ├── Proxy
 ├── Firewall
 └── Threat Intelligence

Your Role

You are:

Tier 2 SOC Analyst

Your responsibility is to:

Validate
Investigate
Correlate
Scope
Assess
Recommend
Escalate
Document

You are not expected to perform uncontrolled offensive actions.

All investigation occurs using supplied or simulated security telemetry.

Mission Rules

During this capstone:

You May

search provided telemetry
correlate security events
inspect authorized evidence
investigate supplied endpoints/logs
analyze indicators
build timelines
recommend containment
document findings
simulate escalation

You Must Not

interact with unknown external systems
execute suspicious files
visit suspicious URLs
test external infrastructure
perform unauthorized scanning
perform offensive validation outside the lab

Investigate the evidence. Do not recreate the threat.

Part 1 — Create the Capstone Workspace

Create:

SOC-Labs/
└── Lab-15-Enterprise-Capstone/
    ├── 01-Case/
    ├── 02-Alert/
    ├── 03-Scope/
    ├── 04-Assets/
    ├── 05-Identities/
    ├── 06-Email/
    ├── 07-Windows/
    ├── 08-Endpoint/
    ├── 09-DNS/
    ├── 10-Proxy/
    ├── 11-Network/
    ├── 12-SIEM/
    │   ├── Queries/
    │   └── Exports/
    ├── 13-Threat-Intelligence/
    ├── 14-Correlation/
    ├── 15-Timeline/
    ├── 16-Scoping/
    ├── 17-Impact/
    ├── 18-Containment/
    ├── 19-Escalation/
    ├── 20-Evidence/
    │   ├── Original/
    │   ├── Working/
    │   └── Redacted/
    ├── 21-Findings/
    └── 22-Final-Report/

Create your investigation notebook:

Enterprise-SOC-Capstone.md

Part 2 — Open the Case

Create:

CASE ID:
GHC-SOC-CAP-001

ORGANIZATION:
NovaCore Financial Services

CASE TITLE:
Enterprise Security Investigation

ANALYST:

DATE:

STATUS:
New

INITIAL PRIORITY:
Pending Triage

INITIAL SEVERITY:
High

INITIAL CONFIDENCE:
Low

Notice:

Severity:
High

Confidence:
Low

That is intentional.

The alert may indicate potentially serious activity, but you have not yet established what happened.

Part 3 — The Initial Alert

Your SIEM generates:

ALERT ID:
ALT-CAP-001

ALERT TITLE:
Suspicious Endpoint and Outbound Network Activity

TIME:
2026-08-28 15:24:01 UTC

HOST:
WIN-FIN-02

IP:
10.10.20.45

USER:
finance-user

PROCESS:
InvoiceViewer.exe

DESTINATION:
203.0.113.50

DESTINATION PORT:
443/TCP

NETWORK ACTION:
Allowed

EDR ACTION:
Detection Generated

INITIAL SEVERITY:
High

This is all you initially know.

Part 4 — Do Not Jump to a Conclusion

Do not immediately write:

Malware compromised finance workstation.

You have an alert.

You do not yet have a complete incident.

Start with:

What does the alert actually establish?

Part 5 — Preserve the Original Alert

Save the alert unchanged.

Assign:

EV-CAP-001

Record:

EVIDENCE ID:
EV-CAP-001

TYPE:
SIEM Alert

SOURCE:
SIEM

HOST:
WIN-FIN-02

USER:
finance-user

EVENT TIME:
15:24:01 UTC

DESCRIPTION:
Suspicious endpoint and outbound network activity alert.

INTEGRITY:
Original evidence preserved.

Part 6 — Perform Initial Alert Triage

Determine:

Alert Severity

How serious does the detection potentially appear?

Asset Criticality

What is WIN-FIN-02?

Identity Context

Who is finance-user?

Detection Confidence

How reliable is the detection?

Potential Impact

What could this activity represent?

Urgency

Does investigation need immediate prioritization?

Part 7 — Build the Triage Record

ALERT TRIAGE

Alert ID:

Severity:

Asset:

Asset Criticality:

User:

Identity Privilege:

Detection Source:

Potential Impact:

Initial Confidence:

Priority:

Immediate Escalation Required:
Yes / No

Reason:

Part 8 — Establish Asset Context

The Asset Register contains:

Asset	Role	Criticality
WIN-FIN-02	Finance workstation	High
WIN-HR-04	HR workstation	Medium
WIN-SALES-03	Sales workstation	Medium
FIN-SRV-01	Finance application server	Critical
AUTH-SRV-01	Authentication server	Critical

Record:

PRIMARY ASSET:
WIN-FIN-02

BUSINESS FUNCTION:
Finance

CRITICALITY:
High

This increases the importance of the alert.

Part 9 — Establish Identity Context

Identity records show:

USER:
finance-user

ROLE:
Finance Analyst

PRIVILEGE:
Standard User

PRIMARY DEVICE:
WIN-FIN-02

MFA:
Enabled

EXPECTED HOURS:
08:00–18:00

At this stage:

The user is a standard account operating during expected working hours.

That does not make the activity benign.

Part 10 — Define Investigation Questions

Before searching randomly, define what you need to determine.

Q1:
Did InvoiceViewer.exe actually execute?

Q2:
Where did the file originate?

Q3:
What process initiated it?

Q4:
What network activity followed?

Q5:
Is 203.0.113.50 relevant to the incident?

Q6:
Was the user exposed through email?

Q7:
Was a suspicious URL accessed?

Q8:
Were credentials potentially exposed?

Q9:
Did the account authenticate from unusual sources?

Q10:
Are additional systems affected?

Q11:
Was persistence established?

Q12:
Was sensitive data accessed?

Q13:
Was data transferred externally?

Q14:
What security controls responded?

Q15:
Is containment required?

Part 11 — Establish the Initial Investigation Window

Start with:

15:09–15:39 UTC

This provides approximately 15 minutes before and after the alert.

Do not assume this will remain the final window.

Part 12 — Validate the Endpoint Alert

Review supplied endpoint telemetry.

You discover:

15:22:12
File observed:
C:\Users\finance-user\Downloads\InvoiceViewer.exe

Then:

15:23:17
Process creation:
InvoiceViewer.exe

Parent:

browser.exe

Then:

15:24:01
EDR detection generated

Now execution is supported.

Record:

FINDING:
Suspicious file execution confirmed.

CONFIDENCE:
High

Part 13 — Investigate the File

Record:

FILE:
InvoiceViewer.exe

PATH:
C:\Users\finance-user\Downloads\InvoiceViewer.exe

HASH:
CAPSTONE-SIMULATED-SHA256-001

FIRST OBSERVED:
15:22:12 UTC

EXECUTION:
Confirmed

USER:
finance-user

HOST:
WIN-FIN-02

Do not execute the file yourself.

Part 14 — Investigate the Process Chain

Create:

browser.exe
     │
     ▼
InvoiceViewer.exe

Ask:

Was the browser expected?
Was a download observed?
Was the file executed directly?
Were child processes created?
Was suspicious command-line activity recorded?

Suppose the supplied telemetry shows no additional suspicious child process.

Record that fact.

Do not invent one.

Part 15 — Pivot Backward

You now know:

InvoiceViewer.exe

Search backward to determine its origin.

The proxy telemetry shows:

15:22:11 UTC

CLIENT:
10.10.20.45

USER:
finance-user

URL:
https://account-update.example.test/files/InvoiceViewer.exe

ACTION:
Allowed

RESPONSE:
200

This establishes a likely download source.

Part 16 — Investigate DNS Activity

Search:

account-update.example.test

DNS logs show:

15:21:02

CLIENT:
10.10.20.45

QUERY:
account-update.example.test

TYPE:
A

Then:

15:21:03

ANSWER:
203.0.113.50

Now you have:

Domain
   ↓
Resolved IP
   ↓
203.0.113.50

which matches the destination from the original alert.

Part 17 — Build the Initial Correlation

You currently have:

DNS Query
   ↓
Domain Resolution
   ↓
Web Request
   ↓
File Download
   ↓
File Creation
   ↓
Process Execution
   ↓
EDR Alert
   ↓
Outbound Connection

This is much stronger than the original alert alone.

Part 18 — Investigate Network Activity

Firewall telemetry shows:

15:25:08 UTC

SOURCE:
10.10.20.45

DESTINATION:
203.0.113.50

PORT:
443

PROTOCOL:
TCP

ACTION:
Allowed

Endpoint telemetry associates the connection with:

InvoiceViewer.exe

Record:

Post-execution outbound communication was observed from the suspicious process.

Do not record:

Data was exfiltrated.

The evidence does not establish that.

Part 19 — Investigate Email Telemetry

Search for:

account-update.example.test

Email security telemetry reveals:

15:18:10 UTC

FROM:
security-alert@account-verification.example.test

TO:
finance-user@novacore.example

SUBJECT:
Immediate Account Verification Required

DELIVERY:
Delivered

URL:
https://account-update.example.test/verify

Assign an evidence ID.

Part 20 — Expand the Timeline Backward

Your first-seen activity changes from:

15:21 DNS Query

to:

15:18 Email Delivery

Update the case.

First Seen can change as investigation expands.

Part 21 — Investigate the Email Campaign

Search the sender, subject, and domain across email telemetry.

Results:

Recipients:
12

Delivered:
7

Blocked:
5

Do not report:

12 compromised users

Instead:

Campaign Reach:
12

Delivered Exposure:
7

Confirmed Endpoint Impact:
Under Investigation

Part 22 — Build the Campaign Register

User	Delivered	Domain Query	Web	File	Execution
finance-user	Yes	Yes	Yes	Yes	Yes
hr-user	Yes	Yes	No evidence	No	No
sales-user	Yes	No	No	No	No

Continue for the available simulated recipients.

This immediately demonstrates:

Campaign Scope ≠ Compromise Scope

Part 23 — Investigate Additional DNS Hits

Suppose:

WIN-HR-04

queried:

account-update.example.test

at:

15:29 UTC

But proxy telemetry shows:

ACTION:
Blocked

Classify:

WIN-HR-04:
Exposed

Confirmed Compromise:
No

Part 24 — Investigate Additional Hash Matches

Search:

CAPSTONE-SIMULATED-SHA256-001

across endpoint telemetry.

Result:

WIN-FIN-02:
Match

Other Endpoints:
No match

This strengthens the current endpoint scope.

But remember:

No Hash Match ≠ Absolute Proof No Other Host Was Affected

Coverage matters.

Part 25 — Validate Endpoint Coverage

Create:

Host	EDR	Coverage	Assessment
WIN-FIN-02	Yes	Complete	High confidence
WIN-HR-04	Yes	Complete	High confidence
WIN-SALES-03	Yes	Complete	High confidence

If a system lacks EDR, record the telemetry gap.

Part 26 — Investigate Authentication

Search:

finance-user

around the incident window.

You discover:

15:32:18 UTC

USER:
finance-user

RESULT:
Successful

SOURCE:
198.51.100.27

DESTINATION:
Corporate Remote Access

MFA:
Successful

This requires investigation.

It does not prove credential compromise.

Part 27 — Establish Authentication Context

Check:

known user source?
corporate VPN?
expected location?
registered MFA?
expected device?
simultaneous session?
subsequent activity?

Suppose historical telemetry shows:

198.51.100.27

was previously used by finance-user through the organization’s authorized remote-access service.

The authentication event may therefore be expected.

Record:

ASSESSMENT:
Authentication initially appeared anomalous but was consistent
with established user remote-access behavior.

DISPOSITION:
Expected Activity

CONFIDENCE:
High

This is an important capstone lesson:

Not every suspicious-looking event belongs to the incident.

Part 28 — Investigate Windows Activity

Review the host evidence around:

15:15–15:40 UTC

Focus on relevant security activity:

authentication
process creation
privilege events
service activity
account changes
scheduled activity

Suppose no evidence establishes:

New Service
New User
Privilege Escalation
Scheduled Persistence

Record:

Persistence:
Not established in available Windows telemetry.

Do not write:

No persistence occurred.

Part 29 — Investigate Privilege Activity

Determine whether finance-user obtained unusual privileges.

If none are observed:

PRIVILEGE ESCALATION:
Not established

CONFIDENCE:
Medium / High

depending on telemetry coverage.

Part 30 — Investigate Internal Network Activity

Search connections from:

WIN-FIN-02

to internal systems after execution.

Suppose normal traffic to:

FIN-SRV-01

appears.

Before declaring lateral movement, establish:

normal application relationship
user baseline
destination service
process responsible
authentication context

If the traffic is generated by the normal finance application:

ASSESSMENT:
Expected business communication.

Remember:

Internal Connection ≠ Lateral Movement

Part 31 — Perform Threat Intelligence Enrichment

Enrich:

account-update.example.test

203.0.113.50

CAPSTONE-SIMULATED-SHA256-001

Using the supplied training intelligence dataset.

Example:

Indicator	Reputation	Confidence
Domain	Malicious	High
File Hash	Malicious	High
IP	Suspicious	Medium

Do not allow external reputation to replace local evidence.

Part 32 — Correlate Threat Intelligence Locally

The domain is valuable because:

Email
  +
DNS
  +
Proxy
  +
File Download

all reference it.

The hash is valuable because:

Downloaded File
  +
Endpoint File
  +
EDR Detection

align.

The IP is useful because:

DNS Resolution
  +
Firewall Communication

align.

Part 33 — Create the IOC Register

IOC ID	Type	Value	Local Evidence	Confidence
IOC-001	Domain	account-update.example.test	Email/DNS/Proxy	High
IOC-002	IP	203.0.113.50	DNS/Firewall	Medium
IOC-003	Hash	Simulated SHA-256	Proxy/EDR	High

Part 34 — Search the SIEM Across All Sources

Use the SIEM to search by:

WIN-FIN-02

finance-user

10.10.20.45

account-update.example.test

203.0.113.50

InvoiceViewer.exe

CAPSTONE-SIMULATED-SHA256-001

Record every meaningful search.

Part 35 — Create the Query Register

Query	Purpose	Result
Q-001	Host search	Related endpoint events
Q-002	User search	Auth/email/proxy
Q-003	Domain search	Email/DNS/proxy
Q-004	IP search	DNS/firewall
Q-005	Hash search	Endpoint scope

Your exact syntax can vary by SIEM.

The methodology should remain reproducible.

Part 36 — Create the Pivot Register

Pivot	From	To	Result
P-001	Alert	Host	WIN-FIN-02
P-002	Host	Process	InvoiceViewer.exe
P-003	Process	File	Downloaded file
P-004	File	URL	Suspicious domain
P-005	Domain	Email	Campaign discovered
P-006	Domain	Hosts	Additional exposure

Part 37 — Correlate the Evidence

Create the correlation chain:

Email
  │
  ▼
Suspicious URL
  │
  ▼
DNS Query
  │
  ▼
Domain Resolution
  │
  ▼
Proxy Request
  │
  ▼
File Download
  │
  ▼
File Observed
  │
  ▼
Process Execution
  │
  ▼
EDR Detection
  │
  ▼
Outbound Communication

Each arrow should have supporting evidence.

Part 38 — Separate Correlation from Causation

Do not say:

The email caused malware execution.

unless your evidence chain supports the intermediate stages.

Here it does support:

Email URL
      +
DNS
      +
Proxy
      +
Matching File
      +
Endpoint Execution

Therefore you can state:

The evidence supports a phishing-related delivery chain leading to execution of the suspicious file on WIN-FIN-02.

Part 39 — Normalize Time

Use:

UTC

Create:

Source	Original	UTC	Ingestion
Email		15:18:10
DNS		15:21:02
Proxy		15:22:11
Endpoint		15:23:17

Remember:

Event Time ≠ Ingestion Time

Part 40 — Build the Master Incident Timeline

Your validated timeline may look like:

UTC	Source	Event	Confidence
15:18:10	Email	Message delivered	High
15:21:02	DNS	Suspicious domain queried	High
15:21:03	DNS	Domain resolved	High
15:21:05	Proxy	Web interaction	High
15:22:11	Proxy	File downloaded	High
15:22:12	EDR	File observed	High
15:23:17	Endpoint	File executed	High
15:24:01	EDR	Detection generated	High
15:25:08	Firewall	Outbound connection	High
15:26:10	EDR	Process terminated	High
15:27:02	EDR	File quarantined	High
15:29:00	DNS/Proxy	HR exposure blocked	High
15:32:18	Identity	Expected remote login	High

The last entry may be chronologically close but not incident-related.

Do not automatically include it in the malicious activity chain.

Part 41 — Establish First Seen

Current evidence:

FIRST SEEN:
15:18:10 UTC

EVENT:
Suspicious email delivered to finance-user

CONFIDENCE:
High

Part 42 — Establish Last Relevant Seen

Do not use the expected authentication event merely because it occurred later.

Suppose the final confirmed incident-related activity is:

15:29
Related domain activity on WIN-HR-04 blocked by proxy

Your incident/campaign last-seen boundary may therefore differ depending on what you are measuring.

Document separately:

PRIMARY HOST LAST ACTIVITY:
15:27:02

CAMPAIGN LAST OBSERVED ACTIVITY:
15:29:00

This is more precise.

Part 43 — Determine Primary Host Scope

For:

WIN-FIN-02

you have:

Email-related interaction:
Confirmed

Domain interaction:
Confirmed

File download:
Confirmed

File execution:
Confirmed

Outbound communication:
Confirmed

EDR detection:
Confirmed

Process termination:
Confirmed

File quarantine:
Confirmed

Classification:

Confirmed Affected

Part 44 — Determine Additional Host Scope

For:

WIN-HR-04

you have:

Domain query:
Observed

Web request:
Blocked

File download:
Not observed

Execution:
Not observed

Classification:

Exposed — No Confirmed Endpoint Impact

Part 45 — Determine Identity Scope

For:

finance-user

the user is associated with the affected endpoint.

But authentication investigation did not establish account misuse.

Record:

USER INVOLVEMENT:
Confirmed

ACCOUNT COMPROMISE:
Not established

This distinction matters.

Part 46 — Build the Scope Matrix

Entity	Exposure	Impact	Classification
WIN-FIN-02	Yes	Execution	Confirmed Affected
WIN-HR-04	Yes	Blocked	Exposed
finance-user	Yes	Endpoint activity	Involved
finance-user account	Potential	No misuse established	Not Confirmed Compromised

Part 47 — Determine Campaign Scope

Example:

Messages:
12

Delivered:
7

Blocked:
5

Domain Queries:
2 endpoints

Web Interaction:
1 confirmed + 1 blocked

File Downloads:
1

File Executions:
1

Confirmed Affected Endpoints:
1

This is far more useful than:

12 users attacked.

Part 48 — Determine Confirmed Impact

Record:

CONFIRMED IMPACT

Phishing Delivery:
Yes

Suspicious Domain Interaction:
Yes

File Download:
Yes

File Execution:
Yes

Outbound Communication:
Yes

EDR Detection:
Yes

Process Termination:
Yes

File Quarantine:
Yes

Part 49 — Determine What Is Not Established

Record:

Persistence:
Not established

Privilege Escalation:
Not established

Credential Compromise:
Not established

Lateral Movement:
Not established

Sensitive Data Access:
Not established

Data Exfiltration:
Not established

Additional Endpoint Compromise:
Not established

This section is just as important as confirmed impact.

Part 50 — Identify Positive Security Controls

Your investigation demonstrates that several controls worked:

Email Gateway
→ blocked 5 campaign messages

Proxy
→ blocked secondary web interaction

EDR
→ detected suspicious execution

EDR
→ terminated process

EDR
→ quarantined file

DNS Logging
→ supported domain correlation

Firewall Logging
→ established network communication

SIEM
→ enabled cross-source investigation

Part 51 — Identify Security Control Gaps

Potential gaps:

Email:
7 suspicious messages delivered

Endpoint:
Execution occurred before EDR containment

Network:
Initial outbound communication was allowed

User Exposure:
Suspicious social-engineering message reached users

Do not automatically call these “control failures.”

Security controls operate in layers.

Part 52 — Identify Telemetry Gaps

Suppose the evidence does not include detailed packet payloads.

Record:

GAP:
No payload-level network telemetry.

IMPACT:
Unable to determine content transferred during the outbound
connection from network telemetry alone.

Therefore:

Data Exfiltration:
Not established

Part 53 — Create the Evidence Gap Register

Gap	Investigation Impact	Confidence Impact
No payload visibility	Cannot determine transferred content	Medium
Limited process command line	Reduced execution context	Medium

Part 54 — Develop Investigation Hypotheses

Hypothesis 1

A phishing message led to suspicious file execution.

Supported.

Hypothesis 2

The endpoint performed suspicious post-execution network communication.

Supported.

Hypothesis 3

The user’s credentials were stolen and used.

Not supported by current evidence.

Hypothesis 4

The incident spread to additional endpoints.

Not supported by current evidence.

Hypothesis 5

Sensitive information was exfiltrated.

Not established.

Part 55 — Build the Hypothesis Register

Hypothesis	Evidence	Status	Confidence
Phishing → execution	Email/proxy/EDR	Supported	High
Post-execution communication	EDR/firewall	Supported	High
Credential compromise	Auth review	Not established	High
Additional compromise	IOC search	Not established	Medium/High
Exfiltration	Insufficient evidence	Unknown	Low

Part 56 — Determine Incident Classification

The evidence supports:

Confirmed Security Incident

Why?

Because suspicious file execution and related post-execution communication were established.

Part 57 — Determine Severity

Consider:

Confirmed execution
+
Finance workstation
+
Outbound communication
+
Limited confirmed scope
+
No privileged account involvement
+
No established data exfiltration
+
EDR containment

A reasonable lab assessment:

SEVERITY:
High

Part 58 — Determine Confidence

You have corroborating:

Email
DNS
Proxy
Endpoint
Firewall
SIEM

Therefore:

CONFIDENCE:
High

Remember:

High Severity ≠ High Confidence automatically.

Here, both happen to be High for different reasons.

Part 59 — Determine Containment Status

EDR:

Process:
Terminated

File:
Quarantined

But ask whether:

endpoint isolation is needed
identity protection is needed
campaign messages remain
malicious domain remains accessible
other exposed hosts require review

Therefore the initial assessment may be:

Partially Contained

Part 60 — Develop Endpoint Containment Recommendation

For the affected lab endpoint:

TARGET:
WIN-FIN-02

RECOMMENDATION:
Isolate affected endpoint through approved response procedure.

RATIONALE:
Confirmed suspicious execution and outbound communication.

PRIORITY:
P1

EVIDENCE PRESERVATION:
Preserve relevant endpoint and SIEM evidence before destructive
remediation where operationally practical.

Part 61 — Develop Identity Recommendation

Because credential compromise was not established:

Avoid writing:

Account definitely compromised.

Instead:

RECOMMENDATION:
Review and protect the affected identity according to incident
response policy, including active-session review and appropriate
credential/session controls if authorized.

RATIONALE:
User interacted with the phishing-related infrastructure, but
current authentication evidence does not establish account misuse.

Part 62 — Develop Email Containment Recommendation

Recommend:

Identify remaining delivered campaign messages.

Quarantine/remove them through approved email-security procedures.

Block high-confidence campaign indicators where appropriate.

Notify exposed users according to incident-response procedures.

Part 63 — Develop Network Containment Recommendation

For:

account-update.example.test

high-confidence malicious status plus strong local evidence supports blocking.

For:

203.0.113.50

consider the possibility of shared infrastructure before organization-wide blocking.

Domain Block Decision ≠ IP Block Decision

Part 64 — Create the Containment Matrix

Target	Action	Priority	Rationale
WIN-FIN-02	Isolate	P1	Confirmed execution
finance-user	Review/protect sessions	P1/P2	Exposure
Campaign emails	Remove/quarantine	P1	Prevent further exposure
Domain	Block	P1	High-confidence indicator
IP	Evaluate/block as appropriate	P2	Shared-infrastructure consideration

Part 65 — Consider Business Impact

Before recommending containment, record:

ENDPOINT:
Finance workstation

BUSINESS IMPACT:
User temporarily unable to work if isolated.

SECURITY BENEFIT:
Prevents additional endpoint communication.

RECOMMENDATION:
Contain due to confirmed execution and network activity.

Part 66 — Preserve Evidence

Before destructive remediation where practical, preserve:

alert
EDR events
process evidence
file metadata/hash
DNS events
proxy events
firewall events
email evidence
authentication evidence
SIEM exports
Master Incident Timeline

Part 67 — Create the Evidence Register

Evidence	Description	Source
EV-CAP-001	Original SIEM alert	SIEM
EV-CAP-002	File observation	EDR
EV-CAP-003	Process execution	Endpoint
EV-CAP-004	DNS query	DNS
EV-CAP-005	Proxy download	Proxy
EV-CAP-006	Outbound connection	Firewall
EV-CAP-007	Phishing email	Email
EV-CAP-008	EDR containment	EDR

Continue for all important evidence.

Part 68 — Determine Escalation

The case includes:

Confirmed execution
+
Post-execution communication
+
High-value business function
+
Containment requirements

Escalation is justified.

Part 69 — Determine Escalation Teams

Recommended:

Incident Response
Endpoint Security
Email Security

Potentially:

IAM

for identity validation/protection.

No evidence currently justifies escalating every specialist team in the organization.

Part 70 — Create the Escalation Decision

ESCALATION REQUIRED:
Yes

PRIMARY:
Incident Response

SECONDARY:
Endpoint Security
Email Security
IAM

REASON:
Confirmed suspicious execution and post-execution communication
on a high-criticality finance workstation requiring coordinated
containment and continued scope validation.

SEVERITY:
High

CONFIDENCE:
High

Part 71 — Prepare the SOC-to-IR Handoff

CASE:
GHC-SOC-CAP-001

CLASSIFICATION:
Confirmed Security Incident

SEVERITY:
High

CONFIDENCE:
High

PRIMARY HOST:
WIN-FIN-02

PRIMARY USER:
finance-user

FIRST SEEN:
15:18:10 UTC

CONFIRMED ACTIVITY:
Phishing delivery
Domain interaction
File download
File execution
Outbound communication

CONFIRMED AFFECTED ENDPOINTS:
1

EXPOSED ENDPOINTS:
At least 1 additional endpoint

IDENTITY COMPROMISE:
Not established

PERSISTENCE:
Not established

LATERAL MOVEMENT:
Not established

DATA EXFILTRATION:
Not established

CURRENT CONTAINMENT:
Suspicious process terminated
File quarantined

RECOMMENDED NEXT ACTION:
Endpoint isolation, campaign containment, continued scope
validation, identity review, and evidence preservation.

Part 72 — Create the Findings

Finding 01 — Phishing Campaign Reached Corporate Users

SEVERITY:
High

CONFIDENCE:
High

EVIDENCE:
Email telemetry

IMPACT:
Multiple users were exposed to a suspicious campaign.

Finding 02 — Suspicious File Execution Confirmed

SEVERITY:
High

CONFIDENCE:
High

ASSET:
WIN-FIN-02

EVIDENCE:
Proxy + Endpoint + EDR

IMPACT:
Suspicious file execution occurred.

Finding 03 — Post-Execution Network Communication

SEVERITY:
High

CONFIDENCE:
High

EVIDENCE:
EDR + Firewall

IMPACT:
The suspicious process communicated externally after execution.

Finding 04 — Secondary User Exposure Was Blocked

SEVERITY:
Medium

CONFIDENCE:
High

ASSET:
WIN-HR-04

EVIDENCE:
DNS + Proxy

IMPACT:
Interaction occurred, but subsequent web access was blocked.

Finding 05 — Account Compromise Not Established

SEVERITY:
Informational

CONFIDENCE:
High

EVIDENCE:
Authentication history and remote-access context

ASSESSMENT:
The initially suspicious authentication was consistent with
established user behavior.

Part 73 — Build the Impact Matrix

Impact	Status	Confidence
Phishing exposure	Confirmed	High
Web interaction	Confirmed	High
File download	Confirmed	High
File execution	Confirmed	High
External communication	Confirmed	High
Credential compromise	Not established	High
Persistence	Not established	Medium/High
Privilege escalation	Not established	High
Lateral movement	Not established	Medium/High
Data exfiltration	Not established	Low/Medium
Additional compromise	Not established	Medium/High

Part 74 — Document Investigation Limitations

Example:

1. Network telemetry does not provide sufficient payload-level
   visibility to determine the content of the outbound connection.

2. Available process telemetry provides limited command-line
   context.

3. Conclusions are limited to telemetry available during the
   investigation period.

4. "Not established" should not be interpreted as absolute proof
   that an activity never occurred.

Part 75 — Create the Outstanding Questions

Examples:

Was any sensitive local data accessed by the suspicious process?

Did the endpoint perform any additional communication outside
the available telemetry window?

Are all delivered campaign messages accounted for?

Did any additional recipient interact with campaign variants?

Does endpoint remediation identify additional artifacts?

Assign owners where appropriate.

Part 76 — Build the Final Incident Narrative

A strong narrative might read:

At 15:18:10 UTC, the email security platform recorded delivery of a simulated phishing message to finance-user. At 15:21:02, the user’s assigned workstation, WIN-FIN-02, queried the domain contained in the message, followed by proxy-recorded web activity and download of InvoiceViewer.exe. Endpoint telemetry recorded the file on the workstation and confirmed process execution at 15:23:17. EDR generated a detection at 15:24:01, and network telemetry subsequently recorded outbound communication from the affected host to the IP previously returned for the suspicious domain. EDR later terminated the process and quarantined the file.

Campaign scoping identified additional recipients, including an HR workstation that queried the same domain but whose subsequent web request was blocked. No additional file execution was established. Authentication review identified a later login involving finance-user; however, historical remote-access telemetry established that the source was consistent with prior authorized behavior. Available evidence therefore did not establish credential compromise.

The incident is classified as a confirmed security incident affecting one endpoint, with additional campaign exposure but no confirmed additional endpoint compromise. Persistence, privilege escalation, lateral movement, credential misuse, and data exfiltration were not established within the available telemetry.

Part 77 — Write the Executive Summary

Your executive summary should be much shorter than the technical narrative.

Example:

The SOC investigated a high-severity alert involving a finance workstation and confirmed a phishing-related security incident. Multi-source email, DNS, proxy, endpoint, and firewall telemetry established delivery of a suspicious message, user-system interaction with related infrastructure, file download, file execution, and subsequent outbound communication. Endpoint security terminated the suspicious process and quarantined the file. Scoping identified one confirmed affected workstation and additional campaign exposure without evidence of further endpoint compromise. Credential compromise, persistence, lateral movement, and data exfiltration were not established. The incident was rated High severity with High analyst confidence and escalated for coordinated containment and remediation.

Part 78 — Build the Final Case Assessment

FINAL CLASSIFICATION:
Confirmed Security Incident

SEVERITY:
High

CONFIDENCE:
High

PRIMARY VECTOR:
Phishing-related delivery

CONFIRMED AFFECTED HOSTS:
1

EXPOSED HOSTS:
At least 1 additional confirmed exposure

CONFIRMED AFFECTED USER:
finance-user

ACCOUNT COMPROMISE:
Not established

EXECUTION:
Confirmed

OUTBOUND COMMUNICATION:
Confirmed

PERSISTENCE:
Not established

PRIVILEGE ESCALATION:
Not established

LATERAL MOVEMENT:
Not established

DATA EXFILTRATION:
Not established

CONTAINMENT:
Partial

ESCALATION:
Required

CURRENT STATUS:
Escalated to Incident Response

Part 79 — Mission Challenge

Complete the investigation without using the completed examples as your final answer.

Your case worksheet:

# ENTERPRISE SOC CAPSTONE

## Case Information

Case ID:

Analyst:

Date:

Status:


## Initial Alert

Alert ID:

Alert:

Time:

Host:

User:

Process:

Destination:

Initial Severity:


## Triage

Asset Criticality:

Identity Privilege:

Potential Impact:

Initial Confidence:

Priority:

Triage Decision:


## Investigation Questions

Q1:

Q2:

Q3:

Q4:

Q5:


## Endpoint Investigation

Host:

File:

Hash:

Path:

Execution:

Parent Process:

Child Processes:

EDR Action:

Evidence:


## Email Investigation

Sender:

Recipient:

Subject:

URL:

Delivery:

Campaign Size:

Delivered:

Blocked:

Evidence:


## DNS Investigation

Client:

Domain:

Query Time:

Response:

Related IP:

Evidence:


## Proxy Investigation

Client:

User:

URL:

Action:

Response:

Download:

Evidence:


## Network Investigation

Source:

Destination:

Port:

Protocol:

Action:

Related Process:

Evidence:


## Authentication Investigation

User:

Time:

Source:

Result:

MFA:

Expected / Unexpected:

Assessment:

Evidence:


## Windows Investigation

Authentication:

Process Activity:

Privilege Activity:

Services:

Scheduled Activity:

Persistence:

Evidence:


## Threat Intelligence

Domain:

Assessment:

Confidence:


IP:

Assessment:

Confidence:


Hash:

Assessment:

Confidence:


## SIEM Investigation

Queries:

Pivots:

Related Alerts:

Duplicate Events:

Telemetry Gaps:


## Correlation

Email → DNS:

DNS → Proxy:

Proxy → File:

File → Endpoint:

Endpoint → Network:

Identity Relationship:


## Timeline

First Seen:

Event 01:

Event 02:

Event 03:

Event 04:

Event 05:

Event 06:

Event 07:

Event 08:

Last Relevant Seen:


## Scope

Confirmed Affected Hosts:

Potentially Affected Hosts:

Exposed Hosts:

Confirmed Users:

Potential Users:

Campaign Scope:

Domain Scope:

Hash Scope:

IP Scope:


## Confirmed Impact

Phishing Exposure:

Web Interaction:

File Download:

Execution:

Network Communication:

Persistence:

Privilege Escalation:

Credential Misuse:

Lateral Movement:

Data Exfiltration:


## Security Controls

Email Gateway:

DNS Security:

Proxy:

EDR:

Firewall:

SIEM:


## Evidence Gaps

Gap 01:

Impact:


Gap 02:

Impact:


## Severity

Severity:

Rationale:


## Confidence

Confidence:

Rationale:


## Containment

Endpoint:

Identity:

Network:

Email:

Evidence Preservation:

Overall Status:


## Escalation

Required:

Teams:

Reason:

Priority:


## Findings

Finding 01:

Finding 02:

Finding 03:

Finding 04:


## Limitations

Limitation 01:

Limitation 02:

Limitation 03:


## Outstanding Questions

Question 01:

Question 02:

Question 03:


## Final Classification

Disposition:

Severity:

Confidence:

Scope:

Confirmed Impact:

Potential Impact:

Containment Status:

Escalation Status:


## Analyst Conclusion

Write the final evidence-based conclusion here.

Part 80 — Required Evidence Package

Your capstone submission should contain at least:

Case Management

Case Metadata
Original Alert
Triage Record
Investigation Questions

Asset & Identity

Asset Context
Identity Context
Asset Register
Identity Register

Email

Original Email Evidence
Campaign Scope
Recipient Analysis

Endpoint

File Evidence
File Hash
Process Evidence
Parent/Child Analysis
EDR Detection
EDR Response

Network

DNS Evidence
Proxy Evidence
Firewall Evidence
Network Correlation

SIEM

Query Register
Pivot Register
Multi-Source Correlation
Relevant Event Exports

Threat Intelligence

IOC Register
Reputation Context
Local Correlation
Confidence Assessment

Incident Reconstruction

Time Normalization Register
Master Incident Timeline
First Seen
Last Seen
Activity Chain

Scope

Host Scope
Identity Scope
Campaign Scope
IOC Scope
Exposure vs Impact Classification

Impact

Confirmed Impact
Potential Impact
Impact Matrix
Telemetry Gaps

Response

Evidence Preservation Plan
Containment Matrix
Containment Status
Escalation Decision
SOC-to-IR Handoff

Reporting

Findings Register
Executive Summary
Technical Narrative
Limitations
Outstanding Questions
Final Classification
Final SOC Report

Part 81 — Final SOC Report Template

# Enterprise SOC Incident Investigation Report

## 1. Executive Summary

## 2. Case Information

## 3. Initial Alert

## 4. Triage Assessment

## 5. Investigation Objectives

## 6. Investigation Scope

## 7. Asset Context

## 8. Identity Context

## 9. Data Sources Reviewed

## 10. Email Investigation

## 11. Endpoint Investigation

## 12. Windows Investigation

## 13. Authentication Investigation

## 14. DNS Investigation

## 15. Proxy / Web Investigation

## 16. Network Investigation

## 17. SIEM Investigation

## 18. Threat Intelligence

## 19. IOC Register

## 20. Evidence Correlation

## 21. Master Incident Timeline

## 22. Host Scope

## 23. Identity Scope

## 24. Campaign Scope

## 25. Confirmed Impact

## 26. Potential Impact

## 27. Security Control Assessment

## 28. Telemetry Gaps

## 29. Findings

## 30. Severity Assessment

## 31. Confidence Assessment

## 32. Evidence Preservation

## 33. Containment Recommendations

## 34. Escalation Decision

## 35. SOC-to-IR Handoff

## 36. Remediation Recommendations

## 37. Investigation Limitations

## 38. Outstanding Questions

## 39. Final Classification

## 40. Analyst Conclusion

## 41. Evidence Register

Part 82 — Capstone Evaluation Rubric

Use a 100-point assessment.

Area	Points
Alert Triage	5
Investigation Planning	5
Email Investigation	7
Endpoint Investigation	10
Authentication/Host Investigation	8
DNS/Web Investigation	7
Network Investigation	7
SIEM Search & Correlation	10
Threat Intelligence	5
Timeline Reconstruction	8
Incident Scoping	8
Impact Assessment	5
Containment & Escalation	7
Evidence Management	3
Final Reporting	5
Total	100

Recommended Result

90–100
Excellent — Enterprise SOC Ready

80–89
Strong — Investigation Ready

70–79
Developing — Additional Practice Recommended

Below 70
Repeat Key Investigation Labs

The score should evaluate reasoning and evidence discipline, not merely whether the student selected the expected classification.

Part 83 — Critical Evaluation Criteria

A student should lose points for conclusions such as:

IOC match = compromise

Outbound connection = exfiltration

DNS query = successful web access

File download = execution

Suspicious login = stolen credentials

Internal connection = lateral movement

Alert severity = incident severity automatically

No log event = activity did not happen

EDR quarantine = entire incident contained

The capstone is testing whether the student understands those distinctions.

Part 84 — Analyst Decision Points

During the capstone, explicitly record at least five decisions.

Example:

Decision 01
Continue investigation rather than immediately close EDR alert.

Decision 02
Expand investigation backward after identifying web download.

Decision 03
Expand campaign scope after finding phishing email.

Decision 04
Do not classify authentication event as compromise after
baseline validation.

Decision 05
Escalate after confirming execution and post-execution
communication.

For every decision record:

Decision:

Evidence:

Reason:

Confidence:

Next Action:

Part 85 — Final Knowledge Check

Question 1

What is the first responsibility after receiving the alert?

Validate and triage it rather than assuming the alert is an incident.

Question 2

What confirmed execution?

Endpoint/process telemetry.

Question 3

Did the DNS query alone prove the website was accessed?

No.

Proxy/web telemetry was required to establish subsequent interaction.

Question 4

Did the outbound connection prove data exfiltration?

No.

Question 5

Why was the authentication event not classified as compromise?

Because additional identity context showed it was consistent with established authorized behavior.

Question 6

Were all phishing recipients compromised?

No.

Campaign exposure and confirmed compromise were different.

Question 7

Why was WIN-HR-04 classified as exposed?

Because related domain activity occurred, but subsequent web activity was blocked and no execution was established.

Question 8

Why is threat intelligence insufficient by itself?

Because reputation provides context; local telemetry establishes what occurred inside the organization.

Question 9

Why is the incident High severity?

Because suspicious execution and post-execution network activity were confirmed on a high-criticality finance workstation.

Question 10

What is the complete SOC methodology?

Alert → Validate → Investigate → Correlate → Scope → Contain → Escalate → Report

Part 86 — Skills Achieved

After completing the capstone, the student should be able to demonstrate:

SOC alert triage
incident prioritization
asset contextualization
identity contextualization
Windows security investigation
authentication investigation
phishing investigation
endpoint investigation
DNS investigation
proxy/web investigation
network alert investigation
SIEM search methodology
investigation pivots
multi-source event correlation
threat-intelligence enrichment
IOC contextualization
timestamp normalization
timeline reconstruction
first/last-seen analysis
incident scoping
exposure vs compromise classification
impact assessment
severity assessment
confidence assessment
telemetry-gap analysis
evidence management
containment planning
escalation decision-making
SOC-to-IR handoff
incident reporting
evidence-based security communication

Professional Takeaway

A beginner may see:

High-Severity Alert
        ↓
Malware
        ↓
Compromise
        ↓
Block

A professional SOC analyst sees:

Alert
  │
  ▼
What Does the Alert Actually Establish?
  │
  ▼
Validate Telemetry
  │
  ▼
Who / What / When / Where?
  │
  ▼
Search Related Evidence
  │
  ▼
Pivot Across Data Sources
  │
  ▼
Correlate Events
  │
  ▼
Separate Related from Unrelated Activity
  │
  ▼
Reconstruct Timeline
  │
  ▼
Determine Scope
  │
  ├── Affected
  ├── Potentially Affected
  ├── Exposed
  └── Unrelated
  │
  ▼
Determine Confirmed Impact
  │
  ▼
Document Potential Impact
  │
  ▼
Identify Evidence Gaps
  │
  ▼
Assess Severity
  │
  ▼
Assess Confidence
  │
  ▼
Preserve Evidence
  │
  ▼
Recommend Containment
  │
  ▼
Escalate
  │
  ▼
Produce Defensible Report

Always distinguish:

Alert
   ≠
Incident

Phishing Delivery
   ≠
User Interaction

DNS Query
   ≠
Web Access

File Download
   ≠
Execution

IOC Match
   ≠
Compromise

Suspicious Authentication
   ≠
Credential Compromise

Internal Communication
   ≠
Lateral Movement

Outbound Communication
   ≠
Data Exfiltration

Threat Intelligence
   ≠
Local Evidence

High Severity
   ≠
High Confidence

Process Quarantined
   ≠
Incident Fully Contained

No Additional Evidence
   ≠
Activity Never Happened

Final Capstone Question

The entire SOC learning path comes down to one question:

“Can you take an enterprise security alert from first detection to final incident report and produce an investigation another SOC analyst, incident responder, and security leader can trust?”

If the answer is yes, the student has moved beyond learning individual SOC tools.

They have learned the SOC investigation process.

SOC Analyst Labs — Track Complete 🎯

You have now completed the full 15-lab progression:

01  Build Your SOC Analyst Lab
        ↓
02  Security Alert Triage & Prioritization
        ↓
03  Suspicious Authentication Investigation
        ↓
04  Windows Security Event Investigation
        ↓
05  Linux Authentication & System Log Investigation
        ↓
06  Phishing Email Investigation
        ↓
07  Malware & Endpoint Alert Investigation
        ↓
08  Network Security Alert Investigation
        ↓
09  DNS & Web Traffic Investigation
        ↓
10  SIEM Search, Filtering & Event Correlation
        ↓
11  Threat Intelligence & IOC Enrichment
        ↓
12  Incident Timeline Reconstruction
        ↓
13  Incident Scoping, Containment & Escalation
        ↓
14  SOC Investigation Reporting & Case Documentation
        ↓
15  Enterprise SOC Analyst Capstone

The learner has progressed from:

“What does this alert mean?”

to:

“I can validate the alert, investigate the evidence, correlate multiple telemetry sources, determine what actually happened, establish scope and impact, recommend containment, escalate appropriately, and produce a defensible enterprise SOC investigation report.”

SOC Labs complete.