🚀 Demo Scenarios Overview
This document outlines the current status and progress of our SOC and Non-SOC demo scenarios. Each demo corresponds to a specific threat type or a set of security controls area relevant to our solution offerings.
Definitions & Prerequisites
- Victim account: john.doe@legionsecurityai.onmicrosoft.com (you do not need to login to this account, ever). Phishing emails are sent to this account, malware are autmoatically run on a weekly basis on this this account's Win11 device. These trigger the required incident and alerts across all our lab security control and ticketing suite. Enabling us to run demo on live up to date data.
- Demo analyst account: demoanalyst@legionsecurityai.onmicrosoft.com. You must be logged in into this Microsoft account in order to run demos. You can login in to portal.azure.com, it will be enough to have a live session cookie for all other systems. Credentials can be found in 1Password under the name "Demo analyst", along with its 2FA saved in there. It will be most effective to create an Edge profile and login in as work profile with demoanalyst@legionsecurityai.onmicrosoft.com.
- Install 1password browser extension Link
- Install Legion browser extension Link
- Login to Crowdstrike using "Demo Analyst Crowdstrike" credentials in 1Password (due to the fact it's not SSO, needs a separate login).
| Threat Category | Demo ID | Demo Status | Notes / Tools Used | Trigger From Here | Use Case Name |
|---|---|---|---|---|---|
| Anomalous Signin | 1.1 | dev bugs - fix in progress | EntraID, Sentinel, Jira | Link choose latest Jira ticket with name starting as Unfamiliar sign-in properties | Anomalous Sign-in (JIRA, Sentinel) |
| Anomalous Sign-in | 1.2 | dev bugs - fix in progress | Splunk, Defender, Jira | Link choose latest Jira ticket with name starting as Unfamiliar sign-in (Defender,Splunk) | Anomalous Sign-in (Splunk, Defender) |
| Malware | 2.1 | dev bugs - fix in progress | Defender, Jira | Link choose latest Jira ticket with name starting as Malware detected - Defender Alert | Multistage Attack - Endpoint (Defender, Jira) |
| Malware | 2.2 | in-progress | Defender, ServiceNow | Link TBA | |
| Malware | 2.3 | ✅ Completed | Crowdstrike, Jira | Link | Multistage Attack - Endpoint (Crowdstrike, Jira) |
| Phishing | 3.1 | Pending Development - Proofpoint skill | Proofpoint, EntraID, Jira | Link TBA | |
| Phishing | 3.2 | ⭐✅ Completed | Defender, EntraID | Link choose latest Jira ticket with name starting as Phishing Incident (Defender) | Phishing (Jira, Defender) |
| Phishing | 3.3 | dev bugs - fix in progress | Sentinel, EntraID | Link | Phishing (Jira, Sentinel) |
| Non-SOC - Access Requests | 4 | ⭐✅ Completed | EntraID, AWS IAM/Identity Center, Jira | Link | Non-SOC AWS Access Review via Jira |
| DLP | 5.1 | ✅ Completed | Jira, Defender, Purview DLP | Link | DLP (Jira, Defender) |
| DLP | 5.2 | ✅ Completed | Jira, Defender, Purview DLP | Link. If defender link expired, click here, copy latest incident link named "DLP policy (Detect clear text passwords)" and paste it within the Jira ticket | DLP - Purview Alert |
| Re-Investigate Phishing (Optimize your SOC investigation process) | 6 | ✅ Completed | Jira, Defender, JoeSandbox | Link | DLP (Jira, Defender, JoeSandbox) |
| Deep Search - Phishing Campaign | 7.1 | ✅ Completed | Jira, Defender Threat Explorer | Link | Phishing Campaign - Deep Search (Threat Explorer) |
| Deep Search - Phishing Campaign | 7.2 | ✅ Completed | Jira, Defender Advanced Threat Hunting | Link | Phishing Campaign - Deep Search (Threat Hunting) |
| Deep Search - Malware | 7.3 | ✅ Completed | Jira, ServiceNow instance 53 | Link | Malware - ServiceNow Deep Search |
✅ Legend
- Completed: Task or demo has been successfully implemented.
- In Progress: Work is currently underway.
- Pending Quote: Waiting on budget approval or vendor estimate.
- Pending Development: Skill Recorded, Video or demo walkthrough has been captured, Linear ticket raised, waiting for development
📌 Notes
- All demos are part of our internal efforts to showcase Legion's principles
- Each demo is tied to a broader use case in threat detection, response, or prevention.