DIGITAL FORENSICS LAB
Practice reading synthetic logs, identifying indicators and building event timelines from fictional cases.
SYNTHETIC LOGSINDICATOR TRIAGETIMELINE BUILDERLOCAL-ONLYThe Unusual Sign-In
A fictional company, Northbridge Research, notices suspicious activity on a staff account. Examine the records below and reconstruct what happened. All timestamps are in UTC. All names, addresses and events are invented; example IP addresses use documentation-only ranges.
Log Analysis
Classify each event as suspicious or routine based on the context. Select an answer for all six events.
Indicator Investigation
Choose the strongest lead for further investigation. Remember that a source IP, by itself, does not establish the attacker's identity.
Event Timeline Builder
Place the four key events in chronological order. Use the dropdowns to select a different event for each position.
Preserve, Correlate, Respond
Preserve evidence
Record the source, timestamp, timezone and integrity of relevant logs. Preserve originals and work from copies where possible.
Correlate events
Review authentication, identity-provider and account-change records together. Avoid treating a single event as definitive proof.
Contain carefully
Escalate through authorized incident-response procedures. Revoke sessions or reset credentials only through approved processes.
Document uncertainty
Separate observed facts from hypotheses. A fictional IP address or anomalous login does not identify a real person.
Privacy and safety: This exercise uses only built-in synthetic data. It does not read local files, upload logs, contact external services, scan networks or store answers. Do not paste real personal data into training tools.
Explore threats. Test your defenses. Understand digital security.
RETURN TO CYBERSECURITY LAB →