A password-changed screenshot.
Operations / 05
SOC response workpack
Turn an alert into an incident decision, evidence and a recovery test.
This work is currently open on this device. Sign in to save it and continue on another device.
Sign inAn alert does not establish a confirmed incident or its full scope. Analysts distinguish hypotheses from evidence; the incident lead coordinates business impact and response authority. NIST SP 800-61 Rev. 3, final in April 2025, connects response with wider risk management. This account-compromise example keeps timeline, response and learning together.
Map the process
0 / 5 steps reviewed.Step 1 / 5
Enrich the alert
Validate user, device, source, time zone and detection reason. Explicitly state telemetry gaps. An unusual location alone is not evidence of malicious intent; correlate it with other signals.
Expected evidence
Alert ID and scoped initial record
One control, three perspectives
Which finding is verified?
Separate hypothesis from evidence.
Sourced timelineEvaluate evidence
Claim: Compromised sessions were revoked.
What evidence would you request before closing this claim?
Decision desk
A user has an unusual sign-in and a new forwarding rule.
First decision?
Worked example
This record is fictional. Do not treat sample results as evidence for your own work.
| Time / zone | Source | Finding | Hypothesis | Decision | Authority | Action | Verification |
|---|---|---|---|---|---|---|---|
| 10:15 UTC | Synthetic identity log | Old session active | Token may persist | Revoke and test | Incident lead | Fictional IR-014 | Old session access rejected |
Closure checklist
0 / 4Checks on this screen last for this session only; they do not create closure evidence or compliance approval. Keep organizational records in the downloaded workpaper.
Take it to work
Files in the selected language. The workbook includes blank records, a worked example and a checklist.
Keep learning
Explore related Academy coursesSources and edition
Checked: 2026-10-21 · Edition 2026.10