> For the complete documentation index, see [llms.txt](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/zyberlab/07-security-investigation-basics/security-investigation-checkpoint.md).

# Security Investigation Basics Checkpoint

Use this checkpoint to confirm that the investigation exercises are understood before adding more security tools or more complex scenarios.

## Skills to Confirm

You should now be able to:

* find failed logon events
* investigate an account lockout
* identify who created a domain user
* review a privileged group membership change
* use Sysmon to examine process creation
* connect a process to a network connection
* build a short event timeline
* write a concise investigation finding

## Event IDs Reviewed

| Event ID | Meaning                                             |
| -------- | --------------------------------------------------- |
| 4624     | Successful logon                                    |
| 4625     | Failed logon                                        |
| 4720     | User account created                                |
| 4726     | User account deleted                                |
| 4728     | Member added to a security-enabled global group     |
| 4729     | Member removed from a security-enabled global group |
| 4740     | User account locked out                             |
| Sysmon 1 | Process creation                                    |
| Sysmon 3 | Network connection when enabled                     |

Do not memorize event IDs without understanding the activity they represent. The event details and surrounding context are more important than the number alone.

## Investigation Habit

For any event, practice asking:

```
What happened?
Who performed the action?
Which user or system was affected?
When did it happen?
What happened before and after it?
Was the activity expected?
```

## Final Lab Exercise

Choose one previous scenario and complete it again without following the detailed steps page.

Use only the investigation notes template as your guide.

Your final notes should include:

* the initial observation
* evidence sources
* key events
* a short timeline
* the finding
* the final classification
* any cleanup performed

## Completion Criteria

This section is complete when you can review a small security event, gather the related evidence, explain what happened in plain language, and document the conclusion without relying only on a single log entry.

## What Comes Next

The lab now has a useful foundation across identity, Windows logging, Active Directory monitoring, endpoint telemetry, networking, and basic investigation.

The next stage should add new capability only when there is a clear learning reason for it.