Would you voluntarily spend another five hours on this kind of problem? Why?
Security Operations (SOC & Incident Response) · 90–120 min
Triage one fictional login alert without crying wolf
Experience SOC work as evidence, competing explanations and careful escalation—not staring at a dramatic dashboard.
Start the experiment01 · Setup
What you need
- Basic networking, timestamps and spreadsheet or text-filtering skills. Use only fictional logs you create for this exercise—never copy real account, employer or campus data.
You may stop when the timebox ends. An incomplete result is still useful evidence.
02 · Task
The work sequence
- 01
Create a 12-row fictional CSV with timestamp, user, source IP, result and device fields. Include normal logins, three failures and a later success; use invented names and documentation-only IP ranges.
- 02
Write two competing hypotheses: an attacker guessed a password, or the user mistyped it before succeeding. State what evidence would support or weaken each.
- 03
Sort and filter the events into a timeline. Mark facts, assumptions and missing context separately; do not invent geolocation or device intelligence.
- 04
Write a simple detection rule for repeated failures followed by success. Test it against two benign variations and record where it becomes noisy.
- 05
Produce a six-line escalation note: alert, scope, timeline, evidence, confidence and next safe action. Then write what would make you close it as benign.
03 · Pay attention
Watch your reaction, not only the output
- Did incomplete evidence make you curious enough to investigate without rushing to certainty?
- Could another analyst reconstruct your reasoning from the timeline?
- Did reducing a noisy rule feel like useful engineering rather than hiding alerts?
Plot twist
Difficulty does not mean the career is a bad fit. The useful question is whether curiosity returned after the difficulty.
04 · Reflect
Three honest questions
Which part gave you energy, and which part drained it?
What evidence—not a salary video—would you gather before choosing this path?
This site does not save your answers. Put them in your own notebook if useful.
05 · Where to go next