Week 9 is one long exercise. It is called Operation Quiet Vendor, and it starts the way real investigations start, which is with almost nothing.
You get a briefing and one thread. Everything else you find yourself.
The Briefing
Somebody noticed something small. That is usually how it goes. Not an alarm, not a ransom note, just one event that does not fit the pattern.
Your job is to decide whether it is nothing, and if it is not nothing, to work out how far it goes. Both answers are acceptable outcomes. What is not acceptable is deciding it is nothing because looking further would take effort.
Learning the Rhythm of Pivots
Investigation is a repeating loop. You have one fact. You ask what else touches that fact. You get new facts. You pick the most promising one and repeat.
An IP address becomes the accounts that used it. An account becomes the machines it touched. A machine becomes the processes that ran on it. A process becomes the files it wrote and the connections it opened. Each hop is a search, and each search either widens the picture or closes a door.
The discipline is keeping notes as you go, with timestamps in a single time zone. Investigations fall apart when somebody cannot reconstruct why they believed something three hours ago.
Reconstructing the Intrusion
By the middle of the week you should be able to answer the questions that matter: how did they get in, what did they do next, how did they move, what did they take, and are they still here.
That last question is the one that keeps incident responders up. Declaring an incident over is a decision with real consequences, and the evidence for it is always weaker than you would like.
The Debrief and the Full Kill Chain
At the end you get the full picture, including the parts you missed. Seeing what you walked past is the most useful part of the whole exercise. Everybody misses something, and finding out where your attention ran out is how you get better.
The kill chain is then mapped onto MITRE ATT&CK techniques so you can see the standard names for what you just watched happen.
Writing the Incident Report
The report is graded seriously, because an investigation nobody can read is an investigation that did not happen.
A good report has an executive summary that a non technical reader can follow, a timeline with clear timestamps, an evidence section that shows how each conclusion was reached, a statement of impact, and recommendations that are specific enough to be assigned to somebody.
It also separates fact from assessment. Saying an attacker accessed a share is a fact if a log shows it. Saying they were after the customer database is an assessment, and it needs to be labeled as one along with your confidence level.
Why This Week Matters for Hiring
Most people applying for a first SOC job have never investigated anything. They have watched videos about investigating things.
Finishing this week gives you a specific, detailed answer to the most common interview question in defensive security, which is some version of tell me about an investigation you worked. That is worth more than another certificate, and it is exactly the kind of proof of work covered in our getting hired guide.
Learn This at HackRange
Week 9 is the point where the program stops being training and starts being practice. Everything before it exists to make this week possible.