What Milan demonstrated

Built a complete beginner SOC incident workflow around a phishing-led breach: triaged the email indicators, mapped the attack to kill-chain stages, identified anomalous sign-ins, and selected a containment sequence that cut access before destructive remediation. Also drafted a GDPR-style breach notification and an executive incident summary, then applied the same reasoning to the public Continental case by selecting MFA as the highest-impact control.

• Leakage-Free Threat Triage
• Log-Based Incident Investigation
• Containment Sequencing
• Risk-Based Control Prioritization