OBFH Labs
Reading about incident response is not the same as sequencing a messy timeline at 4 p.m. on a Thursday. These case exercises put realistic — and entirely fictional — evidence in front of you and make you decide, document, and deliver.
Reconstruct a business-email-compromise attempt from five messy, contradictory evidence sources — the core analyst skill of sequencing what actually happened, in what order, in one timezone.
Review the administrative access of a realistic 60-person company across four SaaS platforms. Decide who keeps what, justify every privileged retention, and produce audit-grade evidence.
A tabletop exercise: your managed service provider reports that one of their technician accounts — with admin rights in your environment — was compromised. Work the first four hours, decision by decision.