IR Level I case studies
IR Level I · Put your knowledge to work in context.
IR Level I is a foundational incident-response credential for people who are entering, or have recently entered, a hands-on response role: tier-one SOC analysts, junior CSIRT members, IT or network administrators who now carry escalation duty for security events, and career-changers coming from a general security fundamentals course who want a response-specific qualification on top of it. It is designed to test whether you can work a structured response lifecycle - recognise, triage, scope, contain, clean up, learn - rather than whether you know one vendor's console. The IR Level I case studies are 5 cases and about 4,908 words.
102:14 Alert - Declaring an Incident Against a Plausible Benign Explanation
Northwind Analytics is a 450-person SaaS company. At 02:14 on Monday the SIEM fires: service account svc-backup authenticated to 12 hosts within four minutes, then 3.2 GB left the network for an IP address in a country where Northwind has no customers, staff, or partners.
989 words, about 5 min2$600,000 and a Tabletop That Found the Wrong Things
Meridian Mutual is a 1,200-person insurer. Six weeks ago a tabletop simulated ransomware on the claims-processing application.
958 words, about 5 min3Halting a $180,000-a-Day Line to Stop a Ransomware Spread
Halden Precision operates three manufacturing plants. On Tuesday morning file shares begin encrypting with a .hx7 extension; 40% of file servers are affected and the ERP system is offline.
993 words, about 5 min4Three Intelligence Items, Three Analysts, One Week
Sable Grid runs 200 legacy Linux servers with no EDR agent and 1,800 endpoints with EDR. The SIEM keeps 30 days of searchable data; full packet capture exists only at the internet edge for 72 hours.
945 words, about 5 min5Friday 16:00 - The 72-Hour Clock With Half the Facts
Calder Health is a private company with customers in the EU and the US. On Friday at 16:00 the security team confirms that an unauthorised party accessed its support ticketing system between 2 March and 20 March.
1,023 words, about 5 min