Learn
One alert, exactly as the console would show it, at the hour it would actually arrive. No framing and no hint about whether it is real, because working that out is the skill. Read it, decide what you do first, and only then open the breakdown.
You have fifteen minutes. What are your first three queries, in order, and what single action do you take before any of them? Write down what you expect each query to return before you run it.
Twenty minutes. Is this lateral movement, a misconfiguration, or a backup job nobody documented? Name the three pieces of evidence that would settle it, and say what you would do if you could not get any of them.
These are constructed rather than drawn from real incidents. The alert formats, event IDs, table names and field names are real: an exercise that trains you on an invented schema is worse than no exercise at all.
