BLUE TEAM DRILL PACK (Week 11)
Fictional practice data for DMILZE EdTech. Eko Fresh, its staff and events are invented. Addresses use documentation and private ranges.

You are the Eko Fresh blue team on the morning of 14 April.
Your tutor releases one stage at a time. Do NOT open a stage folder until your tutor tells you to.

stage1/  email_log.csv
stage2/  signin_log.csv, mailbox_audit.csv, firewall_log.csv
stage3/  fileshare_log.csv

At each stage: what do you see, is it real or noise, what do you do now, and who do you tell?
Record every decision and its time in drill_log_template.csv.
