Project · Intermediate · about 16 hours
Run an incident from alert to report
Given an intrusion in a set of logs and artifacts, scope it, build a full timeline, decide containment and recovery, and write a blameless postmortem.
Skills:Communication, Incident response, SIEM and security operations
Part of: Cybersecurity Engineer
Brief
When an incident happens, method beats panic. Practise the full lifecycle on a realistic scenario so the routine is second nature.
What to build
Build or obtain an incident scenario: logs plus artifacts (a suspicious cron entry, a new account, an outbound connection)
Scope it: which hosts, accounts and data are affected, and build a minute-by-minute timeline
Decide containment (isolate, block, disable) while preserving evidence, then eradication (rebuild vs clean) and recovery (restore, rotate secrets), and justify each choice
Extract indicators of compromise and write detections that would catch a repeat
Write the postmortem: summary, impact, timeline, root causes, what went well, and actions with owners and dates
Deliverables
Repository with
timeline.md,response-plan.md,iocs.txt, detections andpostmortem.md
How it is graded
Reviewers check the timeline against the evidence and stress-test your response order (did you preserve evidence before changing things?).
Stretch
Automate collection of the key artifacts into a single evidence bundle with hashes.
Deliverables
- A complete incident timeline built from the provided logs and artifacts
- A containment, eradication and recovery plan with the reasoning and the order
- An indicators-of-compromise list and detections to catch a repeat
- A blameless postmortem with root causes and owned actions
How a reviewer grades it
| Criterion | Weight | What good looks like |
|---|---|---|
| Timeline is accurate and evidence-based | 30% | |
| Response steps are in the right order and preserve evidence | 30% | |
| Postmortem finds real root causes and assigns actions | 25% | |
| Communication (status updates, report) is clear | 15% |