Detection / Fictional validation worksheet

Compare the signal with the expectation.

A detection exercise is useful when its expected evidence is clear. Record observations for this fictional scenario and export a local worksheet.

Choose the exercise

Fictional validation scenario

Changing scenarios clears the current observations and notes.

A fictional administrator account receives an unexpected role in an agreed exercise.

Recorded observations

This describes the selections in your fictional worksheet. Unreviewed signals remain unknown.

Expected signal 01

The role change is recorded with actor, target and timestamp.

Identity audit event observation

Expected signal 02

The relevant rule creates an alert with enough context for triage.

Detection alert observation

Expected signal 03

The exercise owner records the triage decision and next action.

Response record observation

Exercise notes

Local notes only; 4,000 characters maximum. Describe the fictional evidence, gaps and next review step.