Threat: containedIDS · 32 alerts/minFirewall v4.2Endpoint 12 quarantinedZero-day patchedThreat: containedIDS · 32 alerts/minFirewall v4.2Endpoint 12 quarantinedZero-day patchedThreat: containedIDS · 32 alerts/minFirewall v4.2Endpoint 12 quarantinedZero-day patched
SOC · Threat Console
Mission · Step 1 of 5
Spot the Cyber Threat
You're on a SOC shift. Three alerts just fired. Which is the real attack?
Which alert do you investigate first?
A: 400 failed logins to admin account in 5 minutes. B: Employee downloaded a large file at 2 PM. C: Automatic Windows update ran overnight.
Choose your answer, then lock it in.