Module 3 Overview

Module 3 of 3

SOC Investigation

Review Incidents, Response History, and Workflow Previews

⏱ ~30 minutes🏢 Enterprise Tenant (Read-Only)👤 Persona: PriyaLab 9

🔄

Confirm Tenant Switch
Return to the Enterprise Tenant (Tenant 1). In your assigned CloudShare environment, open Credentials → SDC Credentials and use the Admin Username and Password to sign in at sdc.zslogin.net. Do not use the Module 2 Student Admin credentials. This module is read-only: do not send notifications, change incident state, escalate, or configure workflows.

After Alex's policy work and Kevin's tests, Priya explores a separate, pre-populated incident queue in Zscaler Workflow Automation (ZWA). Review incident evidence, existing user notifications and state changes, available actions, and a workflow template preview. The Lab 9 example is an Inline incident for an attachment/post at dlptest.com under CC SSN HIPAA Block — not the student's Lab 6 or 7 document or DP Project Code policy. Allow 20 minutes for Lab 9 and 10 minutes for the knowledge check.

Module Objectives

Question	Capability
How does Priya find and review incidents?	ZWA Incident Dashboard
How does she assess evidence and trigger data?	Incident Details & Violation Content
What status, priority, and prior actions are recorded?	Incident Metadata & State Changes
What notifications have already been sent, and what response is recorded?	User Notifications History
Which response options are available, without executing them?	Actions Menu Exploration
How could notification and escalation be automated?	Workflow Template Preview

Lab in This Module

9

SOC Incident Investigation & Response

What does the existing incident evidence show, and which response options could an analyst use?

20 minPriya→