How to play

1. Read the alert. Rule, host, user, time, severity.
2. Pull up to 4 of 8 evidence sources. Each pull reveals a log snippet.
3. Give a verdict whenever you're ready. You can stop early.
   • True Positive (TP): malicious activity. Escalate.
   • False Positive (FP): the rule misfired on benign activity.
   • Benign True Positive (BTP): the behaviour really happened, but it was authorised (pentest, approved admin work).
4. Pick a reason, then see the full write-up.