> For the complete documentation index, see [llms.txt](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/zyberlab/07-security-investigation-basics/security-investigation-basics.md).

# Security Investigation Basics Overview

This section brings together the evidence sources already introduced in ZyberLab and uses them in small investigation scenarios.

The objective is not to add another security platform. The objective is to practice thinking like an investigator using the tools already available in the lab.

## What You Will Use

The exercises use evidence from:

* Windows Security logs
* Active Directory audit events
* Sysmon
* Event Viewer
* basic network information
* simple system context from `DC01` and `CLIENT01`

## Investigation Questions

Every investigation should try to answer a small set of questions:

1. What happened?
2. When did it happen?
3. Which user or system was involved?
4. Where did the activity originate?
5. What other events happened around the same time?
6. Was the activity expected?
7. What should be documented or cleaned up?

## Simple Investigation Workflow

Use this workflow throughout the section:

```
Understand the Alert
        ↓
Define the Time Window
        ↓
Collect Relevant Events
        ↓
Identify User and Host Context
        ↓
Correlate Related Activity
        ↓
Decide Whether It Was Expected
        ↓
Document the Finding
```

## Lab Scenarios

The section includes simple investigations for:

* repeated failed logons
* an account lockout
* a newly created domain user
* a Domain Admins membership change
* unusual process activity
* an unexpected network connection
* building a short investigation timeline

All activities must remain inside the controlled ZyberLab environment.

## Main Principle

A single event rarely tells the complete story.

The goal is to connect identity, endpoint, process, and network evidence so that an activity can be understood in context.