# Responder brief — S2 (identical across both arms)

**Your role:** SOC detection & response lead for the identity / Active Directory tier. You are the blue cell's
single decision-maker for this incident, centered on **DC01** (a Domain Controller).

**Your simulated tooling / telemetry (this is everything you have):**
- **EDR console on DC01** — alerts, process lineage, agent health / tamper log; can also pull registry- and
  file-access telemetry through the EDR.
- **SIEM** ingesting the DC's **Windows Security log** (network logon 4624, service install 7045) and **AD/DS
  directory-service access auditing** (event 4662, with a SACL on the domain root covering the replication
  control-access rights).
- **Network egress monitor** at the perimeter.

**Response latitude:** isolate a host, disable / rotate an account, force a krbtgt rotation, escalate to IR and
to the ontology/modeling team. You may NOT stand up new sensors mid-incident.

**Turn cap:** 5.