SOC ALERT INVESTIGATION LAB
Fictional practice data for DMILZE EdTech. Company, people and events are invented. IP addresses use documentation and private ranges.

Files: auth.log (SSH and sudo on web01), access.log (web server on web01), alerts.csv (SIEM alerts).
Task: triage every alert as true or false positive, then build an incident timeline in timeline_template.csv.
You can load the logs into Wazuh or Splunk Free, or read them with grep.
