Section 5 · Security Operations worked evidence

Optional guided practice for Windows authentication and incident timelines. The beatit_soc_* files match the two worked videos; the separate depth fixtures belong to earlier exercises. All records are fictional. Inspect the CSV in a spreadsheet or use an authorized Splunk lab. Offline fixture checks do not validate live SPL execution.

Practice by typing, drawing with a stylus or mouse, or writing on the printable workbook. The workspace includes code and math symbols, local drafts and exportable evidence for peer or instructor review.