Respond to a compromised account
A phishing click became a stolen session and a quiet forwarding rule. Read the timeline, contain the account in the right order without overreacting, and write the handover note.
Part of the path Security analyst starter (step 4 of 4)
What you will do
3 tasks1.Read the timeline
Open Maria Santos: what happened to her account.
2.Contain it in the right order
Take the responses in the order the Runbook gives: sign the attacker out, change the password, remove what they left behind, block the phishing sender, then rep...
3.Write the handover note
Write a note for the next analyst.