TRIAGE
Review the available data, identify the most useful sources, and decide where the investigation should begin.
← All challenges
HUNT.
Analyze logs and evidence, identify the compromise, trace the attacker’s activity, and reconstruct the incident before your investigation window closes.
01 / OVERVIEWFOLLOW
HUNT THE ATTACKER
FOLLOW
THE
EVIDENCE.
A compromised environment leaves traces. Teams must work from logs, host evidence, network activity, and investigative clues to determine what happened and how far the attacker reached.
The strongest teams will connect individual observations into a defensible incident narrative. Speed matters, but conclusions must be supported by evidence.
SIGNAL FROM
THE NOISE.
SEARCH
Query logs and evidence for unusual behavior, suspicious access, persistence, and attacker movement.
CORRELATE
Connect events across users, hosts, services, and time to separate meaningful activity from background noise.
TRACE
Determine the initial access path, affected systems, actions taken, and how the compromise expanded.
RECONSTRUCT
Build a clear timeline that explains the sequence of attacker behavior from entry to impact.
REPORT
Submit supported findings, indicators, scope, and response priorities in a concise incident summary.
03 / EVIDENCEWHAT THE
WHAT THE
ATTACKER LEFT.
- Centralized security and system logs
- Authentication and account activity
- Host and endpoint evidence
- Network and service events
- Indicators that must be connected across time
HOW SCORING WORKS
Teams earn points for accurate, evidence-supported answers about the compromise, attacker behavior, scope, timeline, and recommended response. Final question weights, submission format, and tie-break rules will be published before the event.
- Support conclusions with the requested evidence
- Use precise timestamps and affected systems
- Distinguish confirmed facts from reasonable inference
- Submit the final investigation before time expires
04 / PREPARETHINK LIKE
THINK LIKE
AN ANALYST.
Practice reading Windows and Linux logs, authentication records, web and network events, endpoint telemetry, and common indicators of compromise. Build comfort with filtering, timelines, and cross-source correlation.
Good notes matter. Track hypotheses, record supporting evidence, normalize timestamps, and revisit assumptions when new evidence changes the story.
Bootcamp information →SEPTEMBER 20 · ADDIS ABABA