Back to case studies
Beginner45 min - 1 h
Multi-source IOC correlation
The SIEM raises 2,300 “IOC” alerts overnight. Separate noise from signal: threat feed false positives, a DNS beacon, a PowerShell execution and a MISP match.
Briefing
You join the SOC at Carvelle Energy. A new threat intelligence feed was plugged into the SIEM yesterday; this morning, 2,300 alerts are waiting. Your manager asks you to identify what is really malicious and the scope of any compromise.
Fictional scenario and data, built on real techniques. .example domains and documentation IP ranges.
Objectives
- Spot a poor-quality IOC in a feed
- Identify DNS beaconing behavior
- Link events from different sources
- Enrich with MISP
- Determine the incident scope
Tools used in real investigations
SIEM (Splunk, Elastic, Sentinel)MISPVirusTotalLogs DNSEDR
100% Free
Ready to put it into practice?
CyberXTEL is our free platform to train hands-on: certifications, CTFs and a dedicated cyber awareness space.