Build Security Operations From Events to Response
Investigate a fictional customer-platform export from raw events to recovery. Run offline Python for normalization, correlation, intelligence lifecycle, content-rule fixtures and response state; defend a final evidence-based incident decision.
The fictional ShopStream customer platform has delayed export events, incomplete access history, stale intelligence and a response request whose reply is lost. The investigation must distinguish what happened from what could have happened.
Six lessons provide concrete records, executable offline checks, three diagrams each, negative cases and review criteria. Build an event contract, correlation graph, intelligence review, historical-search record and response state machine, then combine them in a worked incident memo and recovery exercise.
The first two lessons are open. Intelligence curation requires a free account; historical search, response automation and the final project are Premium. The historical-search lesson distinguishes its executed Python oracle from the separate native-engine validation an operational rule needs.
When you finish, you can
- Normalize events while preserving tenant, outcome, time and duplicate semantics
- Join session, job and object receipts without inventing causal edges
- Review intelligence revisions, expiry, revocation and sharing restrictions
- Evaluate harmless content rules with explicit corpus and processing limits
- Model duplicate response requests and uncertain remote effects
- Defend recovery with mandatory control receipts and unresolved impact
BEFORE YOU START · You can read event records and short Python programs. All examples use standard-library Python and synthetic records. No malware, sample uploads, live scans or external response actions are required.
Syllabus
Make events usable
Validate collection and parsing, then correlate activity without overstating identity relationships.
Test the hypothesis
Use threat intelligence and historical content search with explicit provenance and corpus limits.
Respond and recover
Bound automated actions and rehearse a complete advisory-driven defensive response.