Capstone: Follow One Incident from Attack to Log

By the end of this lesson you will have deployed a lab machine, read the evidence of one incident on one workstation, and used cd, ls, cat, grep, grep -c, the pipe and head to find the failed and successful sign-ins, the SIEM alert and the suspicious web traffic. You will name the compromised account, recommend the first containment steps, open that account's case folder to capture your flag, and end the lab. This is the hands-on finish of Security Foundations: it brings together the Linux, Windows, networking, logs and incident lessons in one case. This machine belongs to Purple Edge and you have permission to explore it. Everything in it is harmless text, and you only read files; nothing you do changes the machine. If you see an error, that is normal: read it, it usually tells you what went wrong.