The sign-in and travel records establish a meaningful anomaly. The network wall does not establish lateral movement.
TB TRUSTBENCH / NORTHSTAR SOC LAB
0 / 4 INVESTIGATIONS
● FICTIONAL PRACTICE
SELF-GUIDED LEARNING ACTIVITY · WS-17
Do not read the alert.
Investigate the room.
You are the defensive analyst. Use the workstations to reconstruct what happened before you decide whether the AI's urgent containment recommendation is warranted.
Your choices remain in this browser tab; they are not saved as a learner profile or submitted as an assessment. This activity is not a research study.
INVESTIGATION FLOORSELECT A WORKSTATION
CASE BOARD
Pin findings, not impressions.
Complete a workstation investigation to recover a case file.
Select a recovered finding, then choose a reasoning zone. Move it whenever you change your mind.
SUPPORTS 0
CONTRADICTS 0
VERIFY 0
Recover and place all five findings to unlock the decision console.
INVESTIGATION DEBRIEF
The signals deserved attention.
The conclusion did not.
The service desk record corroborates scheduled remote support, but it does not make all activity benign.