Synthetic SOC workbench
Trace evidence, judgement and approval in one case record.
Four inert scenarios exercise a fixed alert-triage workflow. Facts, unknowns and proposed actions stay separate, and every case event is linked by a browser-verified hash chain.
- Fixtures
- 04 synthetic
- Workflow
- soc-alert-triage
- Autonomy ceiling
- A2 prepare
- Action
- Simulation only
SYN-PHISH-001
Credential-harvest email reported
A simulated staff mailbox received a brand-impersonation message linking to a synthetic credential page.
- Entity
- user.alex@example.invalid
- Service
- Synthetic payroll
- Owner
- Exercise controller
- Observed
- 13 Jul 2026 UTC
Bounded classification record
Synthetic fixture lookup, not live AI. An incident family guides investigation; it does not prove compromise or authorise containment.
- Evidence
- fixture references available; analyst verification required
- Incident family
- phishing
- Next step
- analyst-review
- Model / version
- deterministic-scenario-map / 1
- Probabilities / calibration
- Unavailable / not evaluated
- Policy / disposition
- synthetic-triage-v1 / pending-human-review
- Execution authority
- None
Available source references
- EVD-PHISH-01message metadataHeaders, sender and delivery scope for one inert message.
- EVD-PHISH-02URL observationOne denied request to the example-domain URL.