Interactive exploration · Synthetic data
An alert is the beginning.
Explore a fictional event queue, correlate evidence, and guide one incident from acknowledgement through resolution.
Simulation only. Actions update this page’s local scenario; no endpoint is connected or changed. Times are relative to the start of the scenario.
Event volume
Six recorded events across four five-minute windows. This fixed chart describes the full scenario.
Alert queue
Evidence detail
Unexpected script interpreter
workstation-07
A document viewer started a script interpreter. The fictional process chain needs context before any response.
Linked to incident LAB-IR-01
LAB-IR-01 · workstation-07
Suspicious execution
Related events: unexpected interpreter at T+2m, outbound connection at T+4m, scheduled task at T+7m. Only this fictional endpoint is affected by the guided response.
Review the linked alerts and identify the affected endpoint.
- New · Correlate the three endpoint alerts.