Goal
The IR lab trains decisions on lab data, not a corporate playbook copied from NIST with no context.
Status
development. The checklist is public; full telemetry scenarios arrive with the SOC/Wazuh lab.
Incident Response Lab
Triage and incident notes in a lab — alert, facts, decision, escalation.