SIRS case studies
SIRS · Put your knowledge to work in context.
The SIRS credential is aimed at security practitioners who own or support the incident response lifecycle - SOC analysts moving beyond triage, CSIRT members, and IT or risk staff who sit on an incident bridge. It tests whether you can run a structured response rather than recite tool commands: recognising where you are in the lifecycle, scoping an intrusion under time pressure, choosing containment that does not destroy evidence, and closing out an incident with findings that change the organisation. The SIRS case studies are 5 cases and about 3,407 words.
1Encoded PowerShell on a Radiology Workstation: Event or Incident?
At 02:14 on a Saturday, the EDR console at a 420-bed hospital alerts on workstation WS-RAD-117. The alert shows powershell.exe -enc <base64 spawning from a scheduled task named AdobeUpdate , followed by an outbound TLS connection to 185.199.108.153.
679 words, about 3 min2Rebuilding Preparedness After a 20% Budget Cut
A mid-sized insurer with 1,200 employees has an incident response plan last updated three years ago. The plan names a single incident commander who left eight months ago.
688 words, about 3 min3Service Account Logon from a Residential IP
At 02:07, the SIEM shows 37 failed authentications for service account svc backup over four minutes, followed by a successful interactive logon from 198.51.100.77, a residential ISP address. At 02:19, the file server FS-03 begins sending 410 GB to an external cloud storage bucket over three hours.
685 words, about 3 min4Ransomware at a Logistics Firm: Contain, Recover, and Decide on Payment
A logistics company has 800 servers supporting warehouse management, shipping, and route planning. At 06:40 on a Monday, 60 servers display ransomware notes, including the domain controller and the primary backup NAS.
672 words, about 3 min5Coordinating Breach Notification When Law Enforcement Asks for Delay
A retail company discovers on Friday at 16:00 that a payment-page skimmer has captured card data for 120,000 customers. Approximately 2,000 affected customers are in the EU; the rest are spread across 38 US states.
683 words, about 3 min