UQO · Team project in a lab
Designing, instrumenting and running an incident response exercise: another team takes the SOC analyst shift at a small maple syrup producer and must detect, assess and contain an incident unfolding in real time, without shutting production down.
2 h
SOC shift in real time, at most
5
log sources centralised in Splunk
6 wk
sugaring season, when any shutdown costs the most
Scroll: each source lights up, along with its devices, as its logs reach Splunk.
Three segmented zones, a single crossing point: the router-firewall.
192.168.1.0/24
192.168.2.0/24
192.168.3.0/24
Érablière Boréale IT
Nothing moves from one zone to another, or out to the Internet, without crossing the router-firewall. Its logs say who talks to whom.
Reverse proxy, Apache and e-commerce server: the logs of the only service published on the Internet.
Every sign-in and every account change, from servers to office laptops.
The mandatory path to administer a server remotely: every session is recorded.
Valve position and temperature join the logs: production availability and integrity become security signals.
All five sources converge on the central SIEM, the analyst's main source of alerts.
A three-zone architecture behind a router-firewall, logs centralised in Splunk, a bastion for administration, and scripts that inject logs, traffic and alerts at the pace of a real incident. Then the participant brief, the rules of engagement and live facilitation.
The opposite seat: SOC analyst on an environment designed by another team. Separating signal from noise, assessing, requesting proportionate containment and keeping the incident log as events unfold.
Stimuli injected live, with neither content nor timing known in advance, and a status update roughly every 15 minutes, even when nothing has changed.
How the session runs
T+0 → 10 min
Context, access hand-over, tool checks, rules of engagement.
T+10 → 100 min
Stimuli come in: Splunk alerts, emails, employee reports, requests from management.
T+100 → 115 min
Final containment and recovery actions.
T+115 → 120 min
Incident log finalised, last status updates sent.
A more intrusive measure isn't always the best one: in the middle of sugaring season, isolating production without need can cost more than the incident.
Method and rules of engagement
Separate the signal from the noise, correlate it with other sources, rule out false positives.
Assign a severity and a likely scope (zone, assets affected), and justify it.
Proportionate measures, declared and timestamped. Never from a command line on production.
Deal with the cause: the account, access or component behind it.
Confirm things are back to normal before closing the incident.
Keep stakeholders informed at every significant change in status.
Practise decision-making under pressure: contain an incident without sacrificing production, and leave a record management can act on.