Home labs & practical projects

Investigate a suspicious email from evidence to disposition

A project to do with your own tools, with guidance on what to create and capture.

Design project Suggested time: 90–120 minutesNo hardware required for the design

What you could create

A user reports a message asking them to sign into an unfamiliar portal. The SOC needs a defensible disposition and a clear user response.

Example evidence format

Project evidence map (example)

Email triage worksheetScope and inputs

SOC case note and user guidanceDecisions and reasoning

Evidence record (example)

Evidence	What to capture
Email triage worksheet	Show the inputs, scope and decisions behind this record. No link is opened or attachment executed to complete the exercise.
SOC case note and user guidance	Include the evidence supporting your conclusion. The conclusion distinguishes suspicious indicators from confirmed impact.

What you'll need

Document, spreadsheet or diagram tool

Create a fictional email with synthetic headers, a reserved example domain and a harmless attachment description. Include a normal comparison message.

Project record

Keep the working files for email triage worksheet and record assumptions as you go.

Current reference material

Use the linked provider resources to verify the features, access terms and version relevant to your project.

Access & cost

No paid platform is needed for the written version. Use a document, spreadsheet or diagram tool you already have.

The organisation and records are fictional. Write down assumptions; do not substitute confidential employer information.

Suggested milestones

1
Plan and investigate
Inspect sender alignment, message routing and the requested user action.
2
Develop your approach
Build a short evidence table with confidence and unanswered questions.
3
Verify and explain
Write the case disposition, recommended response and escalation conditions.

Evidence worth keeping

Keep clear, organised evidence of your design and any testing you carry out.

1
Email triage worksheet
Show the inputs, scope and decisions behind this record. No link is opened or attachment executed to complete the exercise.
2
SOC case note and user guidance
Include the evidence supporting your conclusion. The conclusion distinguishes suspicious indicators from confirmed impact.

Label design proposals and observed results clearly.

Explain your work

Use these prompts to reflect on your decisions and what you learned.

Which part of your email triage worksheet needed the most judgement?
What observation or assumption changed your approach?
What would you improve, and what have you not verified?

Describe this as a personal project in your portfolio.

Useful resources

Use these resources to deepen your understanding and check key details.

Official certification objectives

Review the current provider requirements and relevant subject areas.

BTL1 official browser-based lab

Check relevance, platform versions and current access terms.

Explore external learning resources

Find relevant providers and check features, access requirements and costs.

A useful starting point

Create a fictional email with synthetic headers, a reserved example domain and a harmless attachment description. Include a normal comparison message.

What a good result looks like

No link is opened or attachment executed to complete the exercise.
The conclusion distinguishes suspicious indicators from confirmed impact.

Finish the project

Keep the decision record and note unanswered questions. A written design is not evidence that a technical control has been tested.

Independent home-project guidance, not an official vendor lab or a claim of complete exam coverage. Use your own tools and label the work accurately.