From scattered alerts to one campaign

Each lab is a stage of the same SOC investigation across three environments (Linux 10.10.10.11, Windows/AD 10.10.10.12, Web 10.10.10.31): triage each host’s alerts, hunt technique by technique, then correlate credential reuse and a shared C2 into a single campaign and write the unified report. Walk them top to bottom, or jump to any stage.