Capstone: Reconstruct the Intrusion

advanced Hands-on lab 90 min 3 tasksSubscription

Given a compromised host, run the full DFIR process to reconstruct the attack and produce the key findings.

This lab is available with a Purple Edge subscription. Sign in to view the full overview and start the lab.

Part of these paths

Launch the lab in your browser. Real Kali, Ubuntu and Windows targets, guided step by step. No setup, no VM downloads.

Updated 2026-09-01