Lab ID: LOG-TRIAGE-01 Outcome: Build a timeline, identify relevant evidence, and maintain competing hypotheses. Environment: Offline text or spreadsheet data set. Time: 60-90 minutes.
Data Design
Include a small set of:
- Authentication events
- Administrative changes
- File or service access
- Endpoint or application alert
- Benign background events
- Missing fields or time-zone differences
Do not include real user data, public IP attribution claims, active malware, or operational secrets.
Learner Tasks
1. Identify the data source and limitations.
2. Normalize time and sort events.
3. Mark events as relevant, background, or uncertain.
4. Build two hypotheses.
5. Identify evidence needed next.
6. Recommend proportionate containment that protects evidence and operations.
7. Produce a status update.
Scoring Evidence
- Timeline accuracy
- Fact/inference distinction
- Quality of competing hypotheses
- Proportionality of actions
- Communication of uncertainty
Reset and Revision
Restore the clean data set. Review whether any clue made the intended answer obvious. Add alternative explanations if the activity rewarded guessing or premature attribution.