# Complete programme: investigation and team evidence workbook

Complete SOC Investigation Programme — ₹14,999; eight solo labs, nine live
lessons (including report review), plus the four-hour Operation Loki team hunt.
Lifetime solo-lab access with twelve launches per UTC calendar month. Loki is
instructor-led and scheduled, not an on-demand solo lab.

## Match a posting to your demonstrated work

Company / role / original URL / location / date checked open:
Experience, qualifications, shifts and product requirements:

| Requirement | Included practice | My evidence / assistance | Gap and next action |
| --- | --- | --- | --- |
| SIEM searches and Windows investigation | Four foundation labs | | |
| Malicious execution | Malicious File Execution | | |
| Phishing-related C2 | Phishing C2 Detection | | |
| Validate conclusions | AI Investigation Validation | | |
| Reconstruct a multi-step attack | Autonomous APT Investigation | | |
| Team investigation and briefing | Operation Loki | | |

Rate demonstrated / guided practice / not yet demonstrated. Check product-specific
SIEM/EDR/ticketing skills, production procedures and employment experience
separately. Completing advanced exercises does not establish an L2 job level.

## Compare two investigations

Case A / Case B:
What changed in the evidence, hypothesis, queries and escalation decision?
Which finding was uncertain? What further evidence would resolve it?

## Validate an investigation claim

Claim / original source events / supported parts / unsupported inference:
Alternative explanation tested / missing evidence / revised conclusion:

## Operation Loki: individual contribution record

Session date / assigned lane / team objective:
What I personally investigated and the evidence I found:
What another lane established (attribute the source):
Handoff I gave: recipient role, key finding, evidence, next action:
How the handoff changed the team’s decision:
My briefing contribution / uncertainty raised / feedback received:

Keep this record locally and bring it to the existing Loki debrief. The current
portfolio editor may not expose a separate Loki entry; do not attach team work
to an unrelated solo-lab score. Share this supplementary record voluntarily,
with private information removed, alongside your solo investigation evidence.

## Interview rehearsal

1. Compare your method across two investigations.
2. How did you verify or challenge an AI analyst’s claim?
3. Which links in the attack chain are proven and which are hypotheses?
4. What evidence justifies escalation, and what would you verify first?
5. Which Loki findings are yours and which came from teammates?
6. Give a two-minute incident briefing and explain how you handled uncertainty.

## Your independent follow-up

After the solo labs, request a changed question in AI Investigation Validation
or Autonomous APT Investigation. Test a specific conclusion against source
records, identify an unsupported inference and state what evidence would
resolve it. This is one follow-up, not an extra follow-up for every lab. The
Loki contribution discussion happens within its existing team debrief.

## Investigation evidence

Lab / date / attempt reference / assistance used (guided, independent or mixed):
Question and evidence needed to support or refute it:
Searches: SPL, source/index, time range/timezone, fields, selected events and why:
Timeline: time | host/user | event/source | significance | confidence:
Findings: established facts, affected scope, tested alternatives and unknowns:
Handoff: proposed priority and why, key evidence, next action and remaining questions:
Interview walkthrough: question → evidence → decision → limitations → next action.

Save these sections against the matching lab in https://portal.cymbytes.com/portfolio.
Capture evidence before the lab closes. Keep secrets and personal data out.
Save, then submit for instructor feedback. Sharing is optional.

## Follow-up submission

Record the instructor-assigned question, lab, actual evidence window/timezone,
assignment date, agreed deadline and help used. Use the existing monthly launch
allowance. Attempt without a walkthrough, tutor or generated answer; reference
documentation is allowed if disclosed. Ask for help if stuck and declare it.

Append clearly labelled Follow-up assessment sections to the same case study;
preserve the original. If guided and independent work coexist, mark mixed and
describe both. Submit for feedback on evidence, method, reasoning/limits and
handoff. This is formative instructor review, separate from platform scoring
and certificate criteria; independence is self-declared unless observed.

## Apply with accurate evidence

CV section: Practical projects / SOC lab investigations. Use only completed
work you can explain and a portfolio link you chose to publish. Lab training
is not employment, an internship or years of professional experience. Check
the vacancy is still open and assess the employer’s full eligibility criteria.
No interview, placement or professional job level is guaranteed.