🚧 Under construction — VoTechWorks is being built. A free tech program — complimentary, as our commitment to get America working.
voTechWorksGrade 13 · a vocational technology learning center, by urbanicity
newSchoolWorks.com › VoTechWorks › Technology & Design › Cybersecurity › Security Information and Event Management (SIEM) › Lesson 11
TEC-CYBE44-06 · Lesson 11 · 24 clock hours · lab

Capstone Scenario: End-to-End SIEM Investigation

Objective. Students independently configure a SIEM environment, detect a multi-stage simulated attack using correlation rules and manual investigation, and produce a complete analyst report documenting the incident.

⚠ Pending professional review

This lesson, its worked examples and its practice questions has not yet been verified by an industry-certified professional or by a certification or approval body. It is a study draft and may contain errors. Do not use it as instructions for work on a job site or on live equipment. Always follow your instructor, your supervising professional, and current official references and regulations.

VoTechWorks program approval and accreditation are still in progress. Credentials are issued only by the certifying bodies named in each program, after their own exams.

Capstone Scenario: End-to-End SIEM Investigation

This lab is the culminating assessment for the SIEM course. You will work alone to set up a live SIEM environment, detect a hidden multi-stage attack, and deliver a professional analyst report. Every skill you have practiced — log ingestion, correlation rules, search queries, timeline reconstruction, and ATT&CK mapping — comes together here.

What to Expect

The capstone has three timed phases. First, you configure the environment: connect log sources, verify data is flowing, and activate your correlation rules. Second, the instructor silently loads a pre-built attack dataset into your SIEM. You do not know which attack stages are present — you must find them. Third, you write a structured report and deliver a five-minute verbal debrief.

This mirrors real-world incident response. Analysts rarely receive a complete picture at the start. You must gather evidence, form hypotheses, and revise them as new data appears.

Phase 1 — Environment Setup

Deploy four log source types to your clean SIEM instance: Windows event logs, Linux authentication logs, firewall logs, and web server logs. After connecting each source, run a simple search to confirm events are arriving — for example, query for any event in the last five minutes and verify the count is nonzero. Activate at least three correlation rules you built earlier in the course. Common choices include failed-login threshold rules, port-scan detection rules, and rules that alert when a new account is used to access multiple hosts in a short window.

Document each log source and rule in your triage template before moving to Phase 2. If a log source is not ingesting, troubleshoot it immediately; missing data is a gap an attacker exploits, and it is a gap that will cost you points on the rubric.

Phase 2 — Attack Playback and Investigation

The injected dataset represents a complete kill-chain with five stages.

Stage 1 — Reconnaissance scan. An external IP conducts a port scan against the network perimeter. Look for firewall logs showing a single source IP generating connection attempts across many destination ports in a compressed time window. Map this to ATT&CK technique T1595 (Active Scanning) or T1046 (Network Service Discovery) depending on evidence.

Stage 2 — Credential brute-force. The attacker targets a login service. Windows Security Event ID 4625 (failed logon) or Linux `/var/log/auth.log` entries showing repeated authentication failures from one source IP are your indicators. A correlation rule that fires after a threshold of failures in a rolling window should alert here.

Stage 3 — Successful login. Following the brute-force, a logon succeeds. Event ID 4624 on Windows or an `Accepted password` line in Linux auth logs, from the same source IP and around the same timestamp, confirms the breach. Note the account name — it becomes a pivot for the next stages.

Stage 4 — Lateral movement. The compromised account is used to access additional hosts. Look for Event ID 4648 (explicit credential logon) or SMB/RDP connections from the beachhead host to internal targets. ATT&CK technique T1021 (Remote Services) covers common lateral movement methods.

Stage 5 — Data staging. Large outbound transfers or archive-creation activity (e.g., `7z`, `zip` commands in process logs, or large POST requests in web logs) indicate the attacker is preparing to exfiltrate data. ATT&CK technique T1074 (Data Staged) applies here.

For each stage, record the exact SIEM query you used, the raw event that confirmed it, the timestamp, and the affected asset. Use ATT&CK Navigator to verify technique IDs before writing them into your report.

Phase 3 — Analyst Report

Your report must include six sections:

1. Executive summary — two to four sentences describing what happened, written for a non-technical manager.

2. Timeline of events — chronological list of each stage with UTC timestamps.

3. Affected assets — hostnames, IP addresses, and accounts involved.

4. Evidence citations — paste or screenshot the SIEM query and result that proves each stage.

5. ATT&CK technique IDs — one or more per stage, with the technique name spelled out.

6. Containment and remediation recommendations — specific, actionable steps such as isolating a host, resetting a credential, or blocking an IP at the firewall.

Vague recommendations such as "improve security" do not meet the rubric standard. Write steps a junior analyst or sysadmin can execute immediately.

Professional Standards and Safety

Even in a lab environment, treat the simulated attack data with the same discipline you would apply to real incident data. Do not share findings with classmates during the assessment — this is an individual exercise. Protect any credentials or IP addresses in the dataset as if they were live production data. In workplace settings, incident data is often subject to legal hold and must be handled under your organization's evidence-preservation policy. Accurate, timestamped documentation is not optional; it is required if the incident ever goes to litigation or regulatory review.

Passing Criteria

You pass the capstone by identifying at least four of the five attack stages, supporting each identified stage with at least one cited SIEM query, using correct ATT&CK IDs, providing actionable recommendations, and submitting the report on time. A late report that would otherwise pass does not earn a passing grade — deadlines in incident response are real.

Key terms9

Multi-stage attackAn intrusion that unfolds across several distinct phases — such as reconnaissance, initial access, lateral movement, and data staging — rather than a single action.
Correlation ruleA logical condition configured in a SIEM that fires an alert when a defined pattern of events occurs, such as repeated failed logins from one source within a time window.
ATT&CK technique IDA unique identifier (e.g., T1046) assigned by MITRE ATT&CK to a specific adversary tactic or technique, used to classify and communicate threat behavior consistently.
Timeline reconstructionThe process of assembling log events in chronological order to show the sequence of an attacker's actions from first contact to final objective.
Lateral movementAttacker activity that involves moving from an initially compromised host to additional systems within the same network, often using legitimate remote-access protocols.
Data stagingThe act of collecting and consolidating data on a compromised system before exfiltration, often involving compression or archiving tools.
Evidence citationA direct reference in an analyst report to the specific SIEM query, log event, or dashboard result that supports a finding, enabling another analyst to reproduce the result.
Executive summaryA brief, non-technical overview of an incident written for decision-makers, covering what happened, what was affected, and what immediate action is needed.
TriageThe rapid assessment of alerts or events to determine their severity and authenticity, allowing analysts to prioritize investigation effort.
In class: Environment setup: students deploy log sources (Windows event logs, Linux auth logs, firewall logs, web logs) to a clean SIEM instance, verify ingestion, and activate at least three previously built correlation rules — all within a defined setup period at the start of the capstone session. · Attack playback and investigation: instructor injects a pre-built multi-stage attack dataset (reconnaissance scan → credential brute-force → successful login → lateral movement → data staging) without telling students which stages are present; students must discover, triage, and document each stage using SIEM search and dashboards. · Written analyst report: students produce a structured report (executive summary, timeline of events, affected assets, evidence citations from SIEM queries, ATT&CK technique IDs, and containment/remediation recommendations) and deliver a five-minute verbal debrief to the instructor.
Materials: SIEM instance, capstone attack dataset (instructor-prepared), analyst report template, ATT&CK Navigator, triage template
Check: Report graded against rubric: all five stages of the attack identified, each stage supported by at least one cited SIEM query, ATT&CK IDs correct, recommendations actionable. Pass = 4 of 5 stages correctly identified with cited evidence AND report submitted on time.

Practice check8

Answer each question, then check it. Nothing is recorded; this is your own practice.

Security Operations
1. During Phase 1 of the capstone, a student connects all four log sources but finds no events arriving from the Linux authentication log. What is the most appropriate first troubleshooting step?
Threats, Attacks and Vulnerabilities
2. A student's correlation rule fires showing 47 failed Windows logon attempts from 198.51.100.22 against the same account within two minutes, followed by one successful logon from the same IP. Which two ATT&CK techniques best describe these consecutive events?
Incident Response
3. In the analyst report, a student writes the remediation recommendation: 'The organization should improve its password policy.' Why does this recommendation fail the rubric?
Security Operations
4. A student observes Event ID 4648 on a Windows host, showing that the account 'jsmith' authenticated explicitly to three internal hosts in rapid succession from the initially compromised workstation. Which ATT&CK tactic category does this most directly represent?
Security Operations
5. Which Windows Security Event ID indicates a successful interactive or network logon and serves as key evidence for Stage 3 (successful login) in the capstone attack dataset?
Threats, Attacks and Vulnerabilities
6. The instructor's attack dataset shows a single external IP sending TCP SYN packets to ports 22, 23, 25, 80, 443, 3389, and 8080 on the perimeter firewall within a 30-second window, with no established sessions. Which ATT&CK technique does this most closely represent?
Incident Response
7. A student's capstone report identifies four of the five attack stages with cited evidence and correct ATT&CK IDs, but the report is submitted 20 minutes after the deadline. According to the lesson's passing criteria, what is the outcome?
Security Operations
8. When writing the evidence citation section of the analyst report, what must be included for each attack stage to satisfy the rubric?
Record this lesson on my transcript. Sign in with your key and enrollment email to record lessons (enroll free if you have no key). This page stays open to read and practise.
← Previous lessonProgram planNext lesson →