SOC Simulator 1.1Beta

Pick a scenario, filter the events, answer the investigation questions and get an explanation. Data is fictional and for learning only.

An overnight alert says the j.cohen account was locked out. Review the events and decide what happened.

SOC Dashboard

TimeComputerUserRisk

Shown: 5 / 5

2026-10-10 02:11:04WS-HR-07j.cohensrc 10.0.8.45
Event ID 4625Risk: Medium
Logon Type 3, Status 0xC000006D, Sub Status 0xC000006A — wrong password
2026-10-10 02:11:09WS-HR-07j.cohensrc 10.0.8.45
Event ID 4625Risk: Medium
Same failure 5 seconds later
2026-10-10 02:11:15WS-HR-07j.cohensrc 10.0.8.45
Event ID 4625Risk: High
Attempt 38 within 2 minutes
2026-10-10 02:11:16DC01j.cohensrc WS-HR-07
Event ID 4740Risk: High
Account locked out. Caller Computer Name: WS-HR-07
2026-10-10 08:02:40WS-FIN-02m.levisrc 10.0.5.12
Event ID 4624Risk: Low
Logon Type 2 during normal hours — background noise

Put the events in the right order, mark fact vs hypothesis and rate your confidence.

2026-10-10 08:02:40WS-FIN-02m.leviEvent 4624
Logon Type 2 during normal hours — background noise
2026-10-10 02:11:16DC01j.cohenEvent 4740
Account locked out. Caller Computer Name: WS-HR-07
2026-10-10 02:11:15WS-HR-07j.cohenEvent 4625
Attempt 38 within 2 minutes
2026-10-10 02:11:09WS-HR-07j.cohenEvent 4625
Same failure 5 seconds later
2026-10-10 02:11:04WS-HR-07j.cohenEvent 4625
Logon Type 3, Status 0xC000006D, Sub Status 0xC000006A — wrong password

Analyst confidence: 3/5

1. What happened?
The user forgot the password onceAutomated password guessing from one addressA DC replication failure
2. Which evidence shows where the attempts came from?
Caller Computer Name in 4740 and Source IP in 4625m.levi's logon at 08:02The account name alone
3. What is the right first action?
Unlock immediately and close the alertDelete the accountInvestigate and isolate WS-HR-07, then reset the password and unlock