Learn
One alert, exactly as the console would show it, at the hour it would actually arrive. No framing and no hint about whether it is real, because working that out is the skill. Read it, decide what you do first, and only then open the breakdown.
You have fifteen minutes. What are your first three queries, in order, and what single action do you take before any of them? Write down what you expect each query to return before you run it.
Twenty minutes. Is this lateral movement, a misconfiguration, or a backup job nobody documented? Name the three pieces of evidence that would settle it, and say what you would do if you could not get any of them.
Say what happened, in what order, and what you need to establish before anybody says the word "contained".
Establish whether this succeeded, and decide what you tell the business in the next thirty minutes.
You have minutes rather than hours. Say what you do first, and what you deliberately do not do.
Each scenario says which kind it is. Constructed means the situation is invented, with real alert formats, event IDs, table names and field names, because an exercise that trains you on an invented schema is worse than no exercise at all. From an advisory means the tradecraft, the sequence and the indicators are taken from a published advisory, cited on the scenario. The victim is invented either way: the point is to practise against what an actor actually does, not to restage somebody else’s bad week.
