Authentication failures
Repeated failures establish an access attempt. They do not establish who controlled the source.
Mini-range / case NS-001
Can you explain this login?
Five failed SSH attempts are followed by one success. Review the simulated evidence, decide what is confirmed, document what remains unknown, and write the incident report.
FREEBEGINNER30–45 MINNO SIGNUPPRODUCES: INCIDENT REPORT
Case file
Start with what is known.
This preview is only part of the evidence. The downloadable lab adds the VPN log, user directory, worksheet, report template, and answer material.
Successful login
The account authenticated successfully. The event is confirmed; malicious intent is not.
Validate context
Compare VPN and user records, identify gaps, and recommend the next investigative action.
Workflow
Alert to defensible artifact.
The learning sequence protects the investigation: brief first, evidence second, workspace third, review last.
Read the brief
Understand scope, affected account, asset, and review window.
Review evidence
Compare auth, VPN, alert, and user-directory records.
Write submission
Build the timeline, findings, unknowns, and recommendation.
Review
Use the answer material after completing your own analysis.
Lab materials
One case. Five artifact roles.
Start with the full pack or open only the learner material you need. Reviewer material is intentionally labeled separately.
Lab 001 ZIP
Scenario, evidence, workspace, report template, sample report, prompts, and review material.
Student worksheet
Guided questions for facts, timeline, unknowns, severity, and next steps.
Incident report template
Editable structure for summary, timeline, evidence, findings, impact, and actions.
Answer material
Expected timeline, findings, unknowns, severity guidance, and recommendations. Open after completing your analysis.
Portfolio outcome / free first
Show the investigation before joining anything.
Finish with a worksheet, evidence-backed timeline, incident report, résumé bullet, and interview story. If the experience helps, request future lab and Career Lab updates afterward.