2.3 Case Reports and Investigation Notes
Key Takeaways
- Case reports are 100 of each SOC Sim's 400 marks (TryHackMe scoring, 29 March 2025)—enough to matter at a 750 pass mark, not optional flavour text.
- The SOC Simulator advice article (11 March 2025) tells you to take clear, concise, actionable notes covering investigation steps, and to recognise attacker behaviour across multiple alerts using cyber kill chain and MITRE ATT&CK thinking.
- A scoring-ready note set includes timestamps, affected assets, related logs, IoCs, the behaviour story, and recommendations a responder can execute.
- Do not get stuck on one alert: document what you have, keep moving, and use the last minutes to finish the report rather than start a new deep hunt.
- Write like a handoff to the next analyst on shift—short labelled fields beat a cinematic recap with no hosts or times.
Case reports are the smallest of the three SOC Sim scoring buckets and the one candidates skip when the queue feels loud. That is a mistake. TryHackMe's scoring article (29 March 2025) still gives Case Reports 100 marks in each 400-mark scenario. Across two scenarios that is 200 marks—more than the entire multiple-choice section. The SOC Simulator advice article (11 March 2025) tells you to document each investigation step in case reports, keep findings actionable and well-structured for escalation, recognise attacker behaviour across multiple alerts, and manage time so you do not get stuck on one alert. This section is how to write that 100-mark artefact while the clock is running.
What the 100 marks are for
A case report is not a novel and not a screenshot dump. It is the record that would let another analyst, or a more senior responder, continue without redoing your Splunk work. Classification says what each alert is. Escalation says this needs action. The report says here is the incident those alerts form, with evidence and next steps.
If you classify and escalate well but leave the report empty, you leave 100 marks on the table and you also weaken escalation: a page that says "please look" without IoCs is not a complete handoff. If you write a long story that never lists a time or a host, you also fail the advice article's "clear and concise" test.
Fields that earn trust (and marks)
Build every scenario's notes from the same skeleton. Fill it as you go; do not save writing for minute 119.
| Field | What to record | Why it scores |
|---|---|---|
| Timestamps | UTC times from alerts and Splunk _time, in order | Shows sequence; matches the published "start with timestamps" method |
| Affected assets | Hostnames, IPs, users, mailboxes, shares | Tells isolation what to touch |
| Related logs | Index/sourcetype plus the event that proved the link | Shows you filtered noise instead of guessing |
| IoCs | Domains, URLs, IPs, hashes, message IDs, filenames | Makes blocking and hunting repeatable |
| Attacker behaviour | Kill-chain stage and ATT&CK technique across alerts | Turns tickets into one incident |
| Recommendations | Concrete actions with owners implied (isolate, block, reset, preserve) | "Actionable" as the advice article uses the word |
| Open questions | What you did not have time to prove | Honesty beats inventing a missing lateral-movement chapter |
Timestamps
Write a one-line timeline, not a paragraph of "then later." Example: 13:02:11 mail delivered → 13:04:44 proxy GET invoice.js → 13:05:02 wscript.exe → 13:05:40 first beacon. If a dynamic alert arrives at 13:41 for the same host, append it. Do not start a second unrelated report unless evidence shows a second actor.
Affected assets
Name the mailbox that received the phish, the user who clicked, the workstation, and any server the workstation touched. "Finance got hacked" is not an asset list. cfo@northwind-log.example, j.patel, WS-FIN-14 (10.20.40.88) is an asset list. Crown-jewel mentions belong here if logs show access to FILE-FIN-01.
Related logs
Point to the evidence class: index=email message ID, index=proxy URL and status, Sysmon process-create, firewall dest 198.51.100.44. You are not pasting 40 raw lines. You are proving you know which logs confirmed the chain.
IoCs
List indicators in a copy-paste block. Separate network IoCs from host IoCs. Note where each was seen. A domain that exists only in the email body but was never fetched is still an IoC; a domain that was fetched is a higher-priority block.
Attacker behaviour across alerts (kill chain and ATT&CK)
TryHackMe's advice article tells you to understand the typical cyber kill chain and MITRE ATT&CK framework and to identify attacker behaviour across multiple alerts. That is the intellectual core of the 100 marks: you noticed that mail, proxy, and C2 tickets are one campaign.
For a phishing-then-C2 chain, a compact mapping is enough:
- Delivery — spearphishing link (ATT&CK T1566.002).
- Exploitation / user execution — user opens the lure; script host runs the payload (T1204.001, T1059).
- Command and control — periodic HTTPS to an external IP (T1071.001).
- Actions on objectives — only if you actually saw them (share access, dumping, extra tooling). Do not invent exfiltration to look advanced.
Kill chain and ATT&CK are complementary here: kill chain is the order; ATT&CK is the technique name you attach to evidence. Unified Kill Chain is not a required label in this chapter; stay with the cyber kill chain stages you can support from logs.
Actionable recommendations
Recommendations are verbs plus objects:
- Isolate
WS-FIN-14from the network via EDR or switch. - Block
updates-cdn-mail.exampleand198.51.100.44on proxy and firewall; add the hash to EDR deny. - Reset
j.pateland review CFO mailbox forwarding rules. - Preserve the original email and the
invoice.jssample; do not forward the malware to random inboxes. - Hunt the IoCs across other hosts (this is how you catch dynamic alerts you have not triaged yet).
"Improve awareness" with no host and no block list is not actionable.
Worked example: short case report for a phishing-then-C2 chain
The following is a teaching sample for Northwind Logistics. It is deliberately short. Length is not a published scoring rubric; completeness of the fields above is.
Incident title: Phishing delivery to CFO mailbox leading to script execution and HTTPS C2 on WS-FIN-14.
Timeline (UTC): 13:02:11 email gateway alert — newly observed sender northwind-logiistics.example to cfo@northwind-log.example. 13:04:44 proxy — WS-FIN-14 / j.patel retrieved http://updates-cdn-mail.example/invoice.js. 13:05:02 Windows process create — wscript.exe with that file as argument. 13:05:40–ongoing firewall/proxy — HTTPS to 198.51.100.44 about every 60 seconds. 13:41:12 (dynamic) Sysmon — wscript.exe spawned cmd.exe querying local users (discovery). No confirmed access to FILE-FIN-01 in the window searched (12:50–14:00).
Assets: Mailbox cfo@northwind-log.example; user j.patel; host WS-FIN-14 (10.20.40.88, finance VLAN). SCAN-01 firewall alert at 13:01:02 reviewed and closed as benign true positive (approved scanner); not part of this incident.
Related logs: index=email (lookalike From, mismatched Reply-To, message ID 20260919-cfo-inv-4412); index=proxy (200 GET invoice.js, referrer = mail link); index=windows (process tree); index=firewall (allowed outbound 443 to 198.51.100.44).
IoCs: domains northwind-logiistics.example, updates-cdn-mail.example; URL http://updates-cdn-mail.example/invoice.js; IP 198.51.100.44; file invoice.js (record hash if Splunk/EDR provided one); user j.patel; host WS-FIN-14.
Behaviour: Delivery (spearphishing link, T1566.002) → user execution after a malicious link (T1204.001 / T1059) → C2 over HTTPS (T1071.001) → limited discovery via cmd.exe. This is one actor path, not three unrelated tickets.
Recommendations: (1) Isolate WS-FIN-14. (2) Block the domains and C2 IP; deny the hash. (3) Reset j.patel; check CFO inbox rules and any other mail from that sender. (4) Hunt 198.51.100.44 and invoice.js across endpoints. (5) Do not re-image until a memory/disk snapshot is taken if policy requires preservation.
Open: No evidence yet of data staging; continue hunt if more dynamic alerts name FILE-FIN-01.
That report can be written in pieces starting at minute 10. When the 13:41 discovery alert arrives, you add one timeline line and bump behaviour—you do not rewrite from scratch.
Concise notes while you still have queue work
Write in labelled bullets as you classify, not in polished prose. Promote bullets into the skeleton during the last 10 minutes. Useful shorthand:
T+/FP/BTPplus alert ID.t=UTC,h=host,u=user.ioc=string copied from Splunk.esc=yes/no plus why.
The advice article's "clear and concise" is a scoring hint: extra adjectives do not replace a missing IP. If the report UI has size limits, cut background, not IoCs.
Time management: do not get stuck on one alert
The same article says the exam is time-sensitive and you should not linger too long on one alert; if unsure, document findings and move forward. Pair that with the technical-issues warning that time running out marks the section 0.
A working rule:
- 5–8 minutes on a stubborn alert: if you cannot prove TP or FP, write the open question, leave a Splunk one-liner in the notes, and take the next ticket.
- Never spend the last 20 minutes on a single maybe-FP while TPs lack a report paragraph.
- Last 10 minutes: stop new hunting. Ensure every TP you classified appears in the timeline, IoC list, and recommendations. Unfinished poetry is worth less than a complete skeleton.
- Dynamic alerts in the last 10 minutes: classify (protect the missed-TP zero), add one timeline line, one IoC, one recommendation. Do not open a new 15-minute rabbit hole.
Case reports score the quality of the investigation you already did. They also are the investigation: if it is not in the notes, the 100-mark bucket cannot see it. Keep the report alive from minute 10 to minute 120, recognise the chain across alerts, and when the clock is short, write and move.
How many marks does TryHackMe's scoring article (29 March 2025) assign to case reports inside one 400-mark SOC Simulator scenario?
You have a phishing alert, a proxy download alert, and a later dynamic C2 alert on the same workstation. What should the case report emphasize?
There are 18 minutes left. One low-severity alert is still confusing, your true positives are classified, and the case report still lacks a recommendation list. What should you do?