OSIR case studies
OSIR · Put your knowledge to work in context.
OSIR stands for Open Source Incident Response, a vendor-neutral credential aimed at practitioners who detect, triage, contain, and document security incidents using freely available tooling and standard operating procedures. It suits SOC analysts moving beyond alert triage, junior incident responders, system and network administrators who own part of an incident response plan, and forensic or GRC staff who need a shared operational vocabulary. The OSIR case studies are 5 cases and about 2,872 words.
1VPN Alert Cluster Before the Executive Call
At 02:10 on a Tuesday, the SIEM generates 60 alerts in 90 minutes for the rule 'VPN failed logins then success.' Twelve alerts share an unfamiliar ASN; three involve disabled service accounts; one is for a privileged finance administrator from an IP geolocated 900 km from her usual city. The service desk has just launched a company-wide password reset after a phishing wave, and the CISO wants a decision before the 08:00 executive call.
646 words, about 3 min2Signed Backup Agent and LSASS Access on Payment Servers
EDR alerts on three application servers at 01:30 during an approved maintenance window: 'LSASS memory access by signed process.' The process path is C: Files .exe, signed by a valid certificate, and the same binary ran on 40 other servers without alerting. The detection rule is a community Sigma rule with a 35% false-positive rate in your estate because the backup agent accesses LSASS for VSS.
603 words, about 3 min3Ransomware on the Engineering File Server During Backup Failure
At 07:05 Monday, a file server hosting 40 TB of engineering drawings begins showing .locked extensions; by 07:20, 12,000 files are encrypted. EDR shows PsExec lateral movement from a finance workstation to two other servers.
553 words, about 3 min4Remote Laptop, Personal Cloud, and Legal Hold
HR reports a remote sales employee may have copied 8,000 customer contact records to a personal cloud drive before resigning. The employee's corporate laptop is powered on, connected to VPN, and BitLocker-encrypted; the user is cooperative and asks to keep working.
525 words, about 3 min5Public S3 Bucket, Unknown IP, and the 72-Hour Clock
At 10:00 Friday, a cloud security analyst confirms that an S3 bucket containing 50,000 customer records, including names, emails, and hashed passwords, was publicly readable for 36 hours. Access logs show 14 GET requests from two IP addresses: one a known security scanner, the other an unknown VPS.
545 words, about 3 min