Alert queue
Incoming alerts, sorted by severity. Assign one to yourself to start investigating.
Assigned to you
You have no alert assigned. Choose one below and press Assign to me. You can work on one alert at a time.
Close all 11 to finish this level.
Close all 15 to finish this level.
Close all 14 to finish this level.
Close all 11 to finish this level.
| Status | ||||||
|---|---|---|---|---|---|---|
| SL-1001 | high | Phishing | Beginner | Awaiting action | ||
An email that looks like it came from company Payroll has reached an employee. The mail system noticed that the sender's web address is not quite ours. | ||||||
| SL-1020 | high | Web attack | Beginner | Awaiting action | ||
The customer portal has a folder that should only hold pictures. A script file (PHP) has appeared in it and someone is running commands through it. This could be a hidden back door called a web shell. | ||||||
| SL-1004 | medium | Network | Beginner | Awaiting action | ||
The firewall saw one computer inside our network try more than 100 different ports in under a minute. A port is a numbered door where a service listens. This looks like a port scan, which attackers use to find weak spots. Our own security team scans too. | ||||||
| SL-1009 | medium | Cloud | Beginner | Awaiting action | ||
One employee's account signed in from two countries only 12 minutes apart. That is too fast to travel. Either someone else has the password, or a VPN (a tool that hides your real location) is making it look that way. | ||||||
| SL-1019 | medium | Malware | Beginner | Awaiting action | ||
A marketing employee downloaded a program that antivirus says is a trojan, a harmful program disguised as something useful. Antivirus removed it. The question is whether it ran first. | ||||||
| SL-1002 | low | Phishing | Beginner | Awaiting action | ||
A newsletter-style email has a link that goes through another website before the final page. The mail system wants a person to check whether it is harmless marketing or a trick. | ||||||
| SL-1007 | low | Malware | Beginner | Awaiting action | ||
Antivirus on a lab laptop caught a file called eicar.com.txt and moved it to quarantine, a locked box where files cannot run. Some detection names are real threats. Others are harmless test files. | ||||||
| SL-1008 | low | Web attack | Beginner | Awaiting action | ||
The web firewall (WAF) blocked several requests to the customer portal that contain database commands. This is called SQL injection: an attacker types database code into a website hoping it will hand over data. | ||||||
| SL-1013 | low | Insider | Beginner | Awaiting action | ||
An administrator logged in from home at 03:19 and restarted a database service on a production server, the live system the business depends on. A rule flagged it because it is outside working hours. | ||||||
| SL-1018 | low | Brute force | Beginner | Awaiting action | ||
One employee's account locked itself after 14 wrong passwords in seven minutes. Someone guessing the password would cause that. So would a device that keeps trying an old saved password. | ||||||
| SL-1041 | low | Malware | Beginner | Awaiting action | ||
A new scheduled task was created on an HR computer, set to run a program every day at 00:00. | ||||||
| SL-1003 | high | Brute force | Intermediate | Awaiting action | ||
A burst of failed logins against a bastion host from one outside address, followed by a successful login. | ||||||
| SL-1005 | high | Network | Intermediate | Awaiting action | ||
The firewall blocked an outbound connection from a finance workstation to an address on a threat feed. | ||||||
| SL-1006 | high | Malware | Intermediate | Awaiting action | ||
EDR saw Microsoft Word start PowerShell with an encoded command on an HR laptop. | ||||||
| SL-1010 | high | Cloud | Intermediate | Awaiting action | ||
Nine MFA prompts in seven minutes for one account late at night, then one approval. | ||||||
| SL-1011 | high | Cloud | Intermediate | Awaiting action | ||
A storage bucket holding customer exports was made publicly readable. | ||||||
| SL-1015 | high | Cloud | Intermediate | Awaiting action | ||
A data warehouse service account signed in from a new network and exported a whole table. | ||||||
| SL-1040 | high | Malware | Intermediate | Awaiting action | ||
Shadow copies were deleted on a file server by a service account at 23:11. | ||||||
| SL-1012 | medium | Insider | Intermediate | Awaiting action | ||
A 1.8 GB upload to a personal file-sharing site after working hours. | ||||||
| SL-1014 | medium | Cloud | Intermediate | Awaiting action | ||
An accounts payable mailbox signed in from an address it has never used before. | ||||||
| SL-1016 | medium | Malware | Intermediate | Awaiting action | ||
PsExec ran commands on 12 file servers within five minutes from an admin jump host. | ||||||
| SL-1017 | medium | Insider | Intermediate | Awaiting action | ||
A Sales account manager downloaded almost 2,000 files in under half an hour. | ||||||
| SL-1039 | medium | Malware | Intermediate | Awaiting action | ||
PowerShell started on a file server with an encoded command, run by a server administrator. | ||||||
| SL-1047 | medium | Network | Intermediate | Awaiting action | ||
The backup repository sent 38 GB to one external address overnight. | ||||||
| SL-1042 | low | Web attack | Intermediate | Awaiting action | ||
The WAF's SQL injection rule matched a search request on the public shop. | ||||||
| SL-1048 | low | Phishing | Intermediate | Awaiting action | ||
One sender emailed 4,212 outside addresses in 12 minutes. | ||||||
| SL-1021 | critical | Cloud | Hard | Awaiting action | ||
One administrator session is being used from two addresses, and a new admin account has appeared. | ||||||
| SL-1022 | critical | Web attack | Hard | Awaiting action | ||
A page nobody deployed appeared on the public file transfer server, and a 6 GB database read followed. | ||||||
| SL-1026 | critical | Malware | Hard | Awaiting action | ||
A signed softphone program ran a Windows system tool after an update and contacted a domain not seen before. | ||||||
| SL-1027 | critical | Malware | Hard | Awaiting action | ||
Shadow copies were deleted and files are being renamed on the finance file server. | ||||||
| SL-1024 | high | Cloud | Hard | Awaiting action | ||
A new MFA device was added to a Finance manager's account minutes after a help desk reset. | ||||||
| SL-1028 | high | Cloud | Hard | Awaiting action | ||
A deployment key was used from a new address in a region we never use, and eight GPU servers started. | ||||||
| SL-1029 | high | Cloud | Hard | Awaiting action | ||
An unverified app was given mailbox access and has read about 2,100 emails. | ||||||
| SL-1023 | medium | Web attack | Hard | Awaiting action | ||
The WAF logged 14 requests containing a Log4Shell attack string, sent to four servers. | ||||||
| SL-1025 | medium | Brute force | Hard | Awaiting action | ||
One outside address tried passwords on 207 accounts, two attempts each, and one sign-in succeeded. | ||||||
| SL-1030 | medium | Network | Hard | Awaiting action | ||
One laptop made 9,214 DNS lookups with very long, random-looking names in an hour. | ||||||
| SL-1043 | medium | Cloud | Hard | Awaiting action | ||
A service account signed in at 02:00 with a password only, using a legacy mail protocol. | ||||||
| SL-1049 | medium | Insider | Hard | Awaiting action | ||
A project manager deleted 1,206 files from a SharePoint site in 14 minutes. | ||||||
| SL-1044 | low | Network | Hard | Awaiting action | ||
Four Marketing users visited a domain that was registered six days ago. | ||||||
| SL-1045 | low | Web attack | Hard | Awaiting action | ||
The WAF blocked 1,840 requests from one address in 40 minutes, using many attack patterns. | ||||||
| SL-1036 | critical | AI | AI Era | Awaiting action | ||
The company AI assistant emailed three Confidential contracts to an unknown outside domain. | ||||||
| SL-1032 | high | AI | AI Era | Awaiting action | ||
A finance clerk reported a voice call asking for an urgent payment to a new supplier. | ||||||
| SL-1033 | high | Phishing | AI Era | Awaiting action | ||
An invoice email sent to 40 staff passed the usual email checks, and three people clicked its link. | ||||||
| SL-1031 | medium | AI | AI Era | Awaiting action | ||
One chatbot session caused 41 customer accounts to be looked up in about five minutes. | ||||||
| SL-1034 | medium | Insider | AI Era | Awaiting action | ||
A Confidential customer file was uploaded to a website in the AI category. | ||||||
| SL-1035 | medium | Cloud | AI Era | Awaiting action | ||
A cloud AI key is making about 30 times its normal usage from seven addresses in three countries. | ||||||
| SL-1037 | medium | Malware | AI Era | Awaiting action | ||
Six staff opened a Word attachment that tried to start PowerShell, and EDR blocked all six. | ||||||
| SL-1038 | medium | AI | AI Era | Awaiting action | ||
A browser add-on sent the text of pages, including finance pages, to an unknown domain from 14 computers. | ||||||
| SL-1046 | medium | AI | AI Era | Awaiting action | ||
A finance clerk reported a call from the CFO asking for a supplier payment to be released today. | ||||||
| SL-1051 | medium | AI | AI Era | Awaiting action | ||
The company AI assistant emailed a signed NDA to an outside address. | ||||||
| SL-1050 | low | AI | AI Era | Awaiting action | ||
An AI service key spent six times its normal daily amount. | ||||||
Found something confusing or unrealistic?