1. What is this lab for?
This lab helps you understand how an organization responds to a
cyberattack, step by step.
It simulates a real-world situation where you need to:
- detect suspicious activity
- analyze what is happening
- identify the root cause
- take action quickly to reduce impact
In short: go from “something is wrong” to “the issue is under
control”.
---
2. Lab Objectives
By the end of this lab, anyone should be able to:
- Understand how attacks are detected
- Read and interpret logs
- Identify abnormal behavior
- Know what actions to take during an incident
- Set up basic monitoring
- Structure an effective response
---
3. Tools Used (Real-world environment)
Main Platform (SIEM)
Splunk
Used to:
- centralize logs
- search for anomalies
- detect attacks
System Logs
Windows Event Logs
Show:
- logins
- errors
- suspicious activities
Advanced Monitoring
Sysmon
Tracks:
- process execution
- network connections
- suspicious behavior
Network Analysis
Wireshark
Analyzes network traffic (what is happening on the network)
---
4. Understanding tabs in Splunk
Search & Reporting
The main working area
Used to:
- search events
- filter activities
- detect anomalies
Example:
index=windows EventCode=4625
→ shows failed login attempts
Dashboard
Global view
Used to:
- visualize attacks
- monitor trends
- track activity in real time
Alerts
Automated detection
Used to:
- get notified when suspicious behavior occurs
- automate monitoring
Data Inputs
Data sources
Used to:
- ingest logs
- connect systems
Settings
Configuration
Used to:
- manage users
- configure data
- adjust system settings
---
5. Setup (Step-by-step)
Step 1: Install Splunk
1. Download the software
2. Install it normally
3. Open in browser:
http://localhost:8000
4. Create admin account
Step 2: Add Data
1. Go to Settings
2. Click Add Data
3. Choose:
- Windows logs
- or other sources
Goal: feed the system with data
Step 3: Install Sysmon (recommended)
1. Install Sysmon
2. Run:
sysmon -i config.xml
Enables deeper visibility
Step 4: Verify Data
In search:
index=main
If results appear → system is working
---
6. Incident Simulation
Step 5: Simulated scenario
Example:
Multiple failed login attempts (brute force attack)
Step 6: Detection
Search:
index=windows EventCode=4625
Shows:
- failed attempts
- targeted accounts
- possible sources
Step 7: Analysis
Key questions:
- Who is attacking? (IP address)
- Who is targeted? (user account)
- How many attempts?
- When did it happen?
Step 8: Timeline reconstruction
Organize events over time:
- start of activity
- repetition
- escalation
Step 9: Create alert
Trigger alert when:
multiple failures in a short time
Enables automatic detection
Step 10: Response actions
Possible actions:
- block suspicious IP
- secure user account
- isolate affected machine
- perform deeper investigation
Step 11: Reporting
A simple report should include:
- what happened
- source of the issue
- impacted systems
- actions taken
- prevention recommendations
---
7. Final Outcome
By the end of this lab:
- Incident is detected
- Situation is understood
- Actions are taken
- Monitoring is improved
- Report is created
---
Conclusion
This lab demonstrates how an organization:
- monitors systems
- detects threats
- investigates incidents
- responds effectively
- improves security posture
Copyright © All rights reserved.