Write a full incident report from a simulated log-based scenario

The brief

Construct a realistic simulated incident scenario yourself: a set of log excerpts showing suspicious activity, for example repeated failed logins followed by a success from a new location, then unusual data access shortly after. Write a full incident report: a timeline reconstructed strictly from the log evidence, a root cause analysis, prioritized containment and remediation steps, and a lessons-learned section naming a specific preventive control.

Suggested stack

What you hand in

• A PDF incident report with a timeline, root cause analysis, containment/remediation, and lessons learned
• The synthetic log excerpts used are included as an appendix
• Each timeline entry cites the specific log line(s) it's built from

Grading happens against the rubric below, so read it before you start — not after.

Why this project is worth your weekend

• Incident response is a writing-heavy discipline that most technical security training skips entirely, and this is the actual deliverable a SOC analyst produces after a real incident.
• A timeline built strictly from evidence, not assumption, is the first thing a real incident review board checks.
• This is scoped as a desk exercise with synthetic logs, so it builds the analytical skill without needing, or being tempted to seek, a live target.

Where people lose points

• A timeline that includes steps not actually supported by the provided log evidence, filling gaps with assumption.
• Remediation steps listed with no priority order, leaving it unclear what to do first in a real incident.
• A lessons-learned section that's generic ("improve monitoring") instead of naming the specific control that would have caught this scenario earlier.