Cases

Practice intrusions with realistic evidence, worked step by step in the jon.glass tools. Everything runs in your browser, and every case is fictional.

Case 01: The overdue invoice

Phishing → C2 → credential theft → lateral movement → data theft. A finance user at Kestrel Freight opens a fake invoice; three hours later the file server is uploading the finance share and the SOC has isolated one laptop. Build the timeline in Mill, work the event logs in Shifu, map the attack in Spoke, take the implant apart in Hexes, test the containment in Scrimmage, run the tabletop in Huddle, and keep the whole case in Tessera.

Level: new analysts · Time: two to three hours · Start the case