How does the shift work?
- 1Context
Read the ticket details and the affected asset.
- 2Evidence
Review the logs and timeline.
- 3Decision
Choose the appropriate action.
- 4Result
See your decision's evaluation.
Your result won't be saved. Create your free profile afterward to continue training.
Step 1 of 4
Context — Read the ticket details and the affected asset.
Free ShiftTRY-SOC-001SOC Analyst
Unusual Login Alert for an Employee Account
The security operations center received an identity system alert flagging a successful login attempt from an unusual geographic location for an employee account on the finance team. The account uses multi-factor authentication, but the login time doesn't match the employee's usual usage pattern.
Affected Asset
- Name: Corporate Identity Portal
- Type: Identity Provider
- Criticality: 4/5
- Used to access email and internal systems.
Affected User
- Name: Sample finance employee
- Department: Finance
- Tenure: 3 years
- Prior incidents: 0