Worked example — a parallel incident (Helix Tickets)

This folder is a worked miniature incident on a different product (Helix Tickets), not the answer key for the Acme Notes capstone. Use it to see the shape of a timeline, a replay fixture, and an ATT&CK mapping. Then write your own artifacts against this repository's compose stack.

AUTHORIZED LAB USE ONLY. Synthetic evidence only. Do not treat these pages as detections or procedures to run outside the lab.

Example artifacts

• Threat model
• Architecture review
• Incident report
• Purple-team report
• Containment runbook
• Security decision record

Start from the capstone brief and the templates beside it for the work you submit.