🌙 The 2AM Alert
An EDR alert fires at 2am: PowerShell spawned from Word on a finance workstation. Work the incident — every choice trades speed against intel against containment.
Whose job is this?
This incident lands on these classes' desks. Their guides carry the certifications, tools and labs that make the calls you just made feel routine.
- Security Operations Center (SOC) AnalystinitiateFighter → SOC Analyst
- Threat Hunter / Detection EngineerinitiateRanger → Threat Hunter
Not sure which one is you? Roll a character.