HackBlue

Labs / Incident timelines

The afternoon a salesperson resigned

HR flagged a leaver. Line up the resignation, a CRM export, uploads to a personal drive, and a USB stick, and record what left and when, measured from the notice.

  • Terminal mission
  • Intermediate
  • 4 objectives
  • 0 of 4 solved

Briefing

An account manager resigned at 15:00 UTC. Leaver monitoring is approved by HR and legal and covers corporate systems only.

You have the HR notice, the web proxy as JSON lines, and the workstation’s kernel log. The question for HR is simple: did customer data leave after notice was given?

analyst@ir-ws

ir-ws · Incident timelines

Type help for the command list and objectives for your tasks. Everything runs in this browser.

Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.