HARBOR-17 / 01 / PRACTICE GUIDE
SOC alert triage and incident scope
Enter Harbor-17 through its first alert. Verify origin, assess service impact and separate observed facts from explanations not yet established.
Download guide and workpapersOriginal AI-assisted SecNet educational content; examples are fictional. Not a source organization publication or endorsement. Sources checked: 2026-10-21.
EVIDENCE REVIEW DESK
Move from observations to decisions.
Code here is a local policy model with no target connection. Passing model cases are not security approval or device tests.
Where is the raw source? / Incomplete decision
Inspect an incomplete decision based on record existence or another positive signal. Consider denial cases alongside permitted use.
s=>s.alertExistsAn alert does not establish source trust or scope. Flag missing raw records in forwarded screenshots; require origin, preservation and scope evidence together.
Choices and outputs last only on this open page; they do not update account progress, career status, points or certificates.
01 / EXPLANATION
Alert, finding and incident
An alert is a tool-condition match, not a confirmed breach. Record source, event ID, raw-record location and ingestion time. When working from a screenshot or forwarded message, identify missing fields. “A successful sign-in was logged” is an observation; account compromise is a hypothesis; session ownership and device context are gaps. This distinction reduces both premature closure and unnecessary disruption.
02 / EXPLANATION
Priority and ownership
Review a vendor critical label alongside business impact. Asset criticality, ongoing behavior, affected identities and reversibility affect priority. Assign case ownership and decision authority; hand over open questions and the next check time. Keep preparation and learning in view: NIST 800-61 Rev.3 is the final 2025 publication connecting incident response to CSF2.0 risk management; do not label Rev.2 current.
03 / EXPLANATION
Scope and visibility gaps
Even if the first host appears clean, review the identity’s mail, SaaS and other-device access. Define search windows, source coverage and retention. Do not treat sensor blind spots as clean. Maintain scope as a versioned working assumption, recording rationale and new sources when it expands. Collect records for the investigation purpose without indiscriminate personal-data gathering.
04 / EXPLANATION
Harbor-17 first decision card
The user reports a helpdesk message at09:00+03:00; the identity record shows08:05+02:00. These are06:00 and06:05UTC. Comparing local clock digits would incorrectly place sign-in before the message. The evidence desk sorts them without establishing causation. An initial decision may be to continue and obtain identity/device context, not identify an attacker. Assign ownership and a return time for missing records.
Build the evidence yourself.
Blank workpapers are not completed tests. Fill them in your authorized environment without secrets or real personal data.
Full guide with code, outputs and reasoning ↓Primary references
Explanations are authored by SecNet. References support method and platform context; verify current editions and organizational policy for real use.