Synthetic SOC workbench
Trace evidence, judgement and approval in one case record.
Four inert scenarios exercise a fixed alert-triage workflow. Facts, unknowns and proposed actions stay separate, and every case event is linked by a browser-verified hash chain.
- Fixtures
- 04 synthetic
- Workflow
- soc-alert-triage
- Autonomy ceiling
- A2 prepare
- Action
- Simulation only
SYN-PHISH-001
Credential-harvest email reported
A simulated staff mailbox received a brand-impersonation message linking to a synthetic credential page.
- Entity
- user.alex@example.invalid
- Service
- Synthetic payroll
- Owner
- Exercise controller
- Observed
- 13 Jul 2026 UTC
Available source references
- EVD-PHISH-01message metadataHeaders, sender and delivery scope for one inert message.
- EVD-PHISH-02URL observationOne denied request to the example-domain URL.