SOC Analyst Capstone

This capstone integrates alert triage, SIEM analysis, detection engineering, incident coordination, threat hunting, intelligence, evidence handling, recovery, and communication through one fictional healthcare intrusion. The objective is not to guess a hidden answer. It is to make defensible decisions from incomplete evidence, preserve uncertainty, ask the next useful question, coordinate action with accountable owners, and improve the system after the incident.