IDLE

SOC Engineer Data Requirements

Name: SOC Engineer Data Requirements
Brand: Hacker Labs

INSTANCE: hl-attacksocdatar · IP: 10.10.23.33 · eu-west-1

TIME01:30:00

Windows Server

Lab not running

Click Launch above to provision a fresh Windows Server VM. Takes ~30s.

Submit flag

0/4 objectives

Scenario

Justify and document logging requirements (PowerShell, Sysmon 1/3, 4688) for ATT&CK coverage.

Objectives — click to toggle

Step-by-step walkthrough

1
Audit current GPO
Run gpresult /h on DC01 and identify enabled audit policies.
2
Deploy Sysmon
Install Sysmon with the SwiftOnSecurity config on 3 endpoints.
```
sysmon64.exe -accepteula -i sysmonconfig.xml
```
3
Enable PowerShell logging
Turn on Script Block Logging (4104), Module Logging and Transcription via GPO.
4
Build the matrix
Produce a CSV: ATT&CK technique → Event ID → Source → Retention → Owner.
5
Write the brief
1-page memo to the CISO justifying log volume + cost vs. ATT&CK coverage uplift.

Submission requirements

Upload deliverables via the Files tab before claiming points.