SecNet.Work · Harbor-17
From an alert to a defensible decision.
One message, one sign-in and two uncertain records. Separate observations from hypotheses, find missing evidence and explain response decisions in this SOC and digital-investigation series.
Review the first alertPrevious package: cloud and KubernetesOrder the case. Keep assumptions visible.
Select a record to see what is known and what remains unproven. Times are UTC views, not proof of source truth or causation.
Message record
- Observed
- Recipient and original +03:00 time recorded.
- Not yet established
- No trusted-receiver header or raw MIME.
Investigation sequence for your role
- 1SOC alert triage and incident scope
- 2Phishing and email investigation
- 3Endpoint triage and process context
- 4Identity, session and SaaS incidents
- 5Network, DNS and cross-source correlation
- 6Digital evidence, hashes and timelines
- 7Response, impact boundaries and clean recovery
- 8Threat hunting, detection and lessons learned
A learning recommendation; choices stay on the open page. No real incident record, career points, exam result or certificate is created.
8 topics, 24 explained scenarios
8 modules
SOC alert triage and incident scope
Enter Harbor-17 through its first alert. Verify origin, assess service impact and separate observed facts from explanations not yet established.
Beginner → intermediate → advancedPhishing and email investigation
Review displayed sender, authentication headers, destination domains and user impact together. Develop evidence without opening suspicious destinations.
Beginner → intermediate → advancedEndpoint triage and process context
Combine parent chains, artifact identity, behavior and sensor coverage before judging a process name.
Beginner → intermediate → advancedIdentity, session and SaaS incidents
Separate MFA results from session ownership. Review passwords, tokens, application grants, mailbox rules and delegation together.
Beginner → intermediate → advancedNetwork, DNS and cross-source correlation
Do not mistake the same IP or second for an evidence chain. Assess source coverage, direction, process linkage and benign alternatives together.
Beginner → intermediate → advancedDigital evidence, hashes and timelines
Separate byte integrity from source truth. Preserve original timestamps, produce a UTC view and trace evidence handling and purpose.
Beginner → intermediate → advancedResponse, impact boundaries and clean recovery
Do not confuse file deletion with containment or service uptime with recovery. Connect identity, persistence, business impact and validation.
Beginner → intermediate → advancedThreat hunting, detection and lessons learned
Move from IOC lists to testable hypotheses. Validate rules against positive and benign negative examples, and turn closure into durable improvements.
Beginner → intermediate → advancedCorrelate the records yourself.
Synthetic JSON events across offsets, a maintenance alternative and actual byte/hash comparison. The Node.js kit needs no package installation or network connection. It is not raw evidence acquisition or real attack detection.
Open the browser evidence deskDownload the Harbor Incident kit