Tell me more about… Forensic Analysis Compromise IOC I need some coffee So who has questions about their ticket? Security event not an IR We need that on the wiki I don’t have access This is TOR I’m helping out on-call We need these logs in Splunk Do I have access to this? IR takes priority I can set you up with a mentor Have you looked in Wiz? Add more resources We will automate Your goal is to mark yourself as pro Did you look at session traffic It’s been a meeting heavy day Does this look malicious? Look at the geographical data This goes to Level 2 Did you notify SVIC? Tell me more about… Forensic Analysis Compromise IOC I need some coffee So who has questions about their ticket? Security event not an IR We need that on the wiki I don’t have access This is TOR I’m helping out on-call We need these logs in Splunk Do I have access to this? IR takes priority I can set you up with a mentor Have you looked in Wiz? Add more resources We will automate Your goal is to mark yourself as pro Did you look at session traffic It’s been a meeting heavy day Does this look malicious? Look at the geographical data This goes to Level 2 Did you notify SVIC?
(Print)
Tell me more about…
Forensic Analysis
Compromise IOC
I need some coffee
So who has questions about their ticket?
Security event not an IR
We need that on the wiki
I don’t have access
This is TOR
I’m helping out on-call
We need these logs in Splunk
Do I have access to this?
IR takes priority
I can set you up with a mentor
Have you looked in Wiz?
Add more resources
We will automate
Your goal is to mark yourself as pro
Did you look at session traffic
It’s been a meeting heavy day
Does this look malicious?
Look at the geographical data
This goes to Level 2
Did you notify SVIC?
