Fictional incident timeline
Look for patterns, not a single suspicious word. Every entry is invented and none refers to a real person or system.
| Time | Account | Action | Origin |
|---|---|---|---|
| 2026-10-20 08:10 | alpha | login_success | office_network |
| 2026-10-20 08:14 | beta | login_failure | remote |
| 2026-10-20 08:15 | beta | login_failure | remote |
| 2026-10-20 08:17 | beta | login_success | remote |
| 2026-10-20 08:22 | beta | large_export | remote |
| 2026-10-20 08:29 | alpha | file_open | office_network |
| 2026-10-20 09:01 | gamma | login_failure | office_network |
| 2026-10-20 09:02 | gamma | login_success | office_network |
| 2026-10-20 09:10 | gamma | file_open | office_network |
Choose an account to inspect:
Select an account to see an evidence-based summary.
Respond like an investigator
- Which sequence would you investigate first? Quote the specific timestamps as evidence.
- Write two alternative explanations for the same log sequence.
- Identify one piece of information that is missing.
- Recommend safe next steps such as account review, permissions check and reporting to the system owner.