Outcome: Define a governed network-forensics and incident-response mission, lifecycle, authority model, roles, safety controls and decision records.

Case: Project Netrakshak opens when a fictional Indian logistics company reports unusual authentication, DNS and outbound traffic. The learner receives a written mandate and synthetic evidence only.

Tools: NFIR charter, role-and-escalation matrix, lifecycle decision log

Outcome: Explain how network architecture, protocols, addressing and sensor placement determine what evidence exists and what conclusions are supportable.

Case: Netrakshak has segmented offices, cloud workloads, VPN users, NAT, proxies and asymmetric routing. The team must map what each sensor can and cannot observe.

Tools: logical topology, protocol-evidence map, sensor coverage register

Outcome: Acquire, preserve, validate and document packet captures and network records without changing originals or exceeding authority.

Case: A volatile traffic window may contain command-and-control and data-transfer evidence. Learners plan and document a bounded capture without touching a live target.

Tools: capture plan, PCAP evidence log, integrity and custody record

Outcome: Analyse packet evidence with Wireshark and TShark using reproducible filters, statistics and protocol reasoning.

Case: A verified synthetic PCAP contains ordinary business traffic mixed with suspicious DNS, TLS and outbound sessions. Learners create repeatable findings, not screenshots alone.

Tools: filter notebook, conversation worksheet, reproducible packet findings

Outcome: Correlate Zeek, NetFlow/IPFIX, DNS and related metadata to identify patterns while accounting for visibility and interpretation limits.

Case: Full packet data is unavailable for part of Netrakshak, but Zeek logs, flow records and DNS telemetry cover the relevant period with documented gaps.

Tools: Zeek correlation sheet, flow-analysis matrix, metadata limitations statement

Outcome: Triage and validate Suricata and SIEM detections, map observed behaviour to ATT&CK and improve detection logic without overclaiming.

Case: Suricata EVE records and SIEM correlations flag possible phishing delivery, remote access and exfiltration. Learners validate each alert against evidence and coverage.

Tools: alert-triage queue, correlation notebook, ATT&CK and detection map

Outcome: Scope affected assets, identities and time ranges, test competing incident hypotheses and build a normalized, source-linked timeline.

Case: Evidence suggests a compromised VPN account, internal discovery and outbound staging, but records conflict. Learners define confirmed, suspected and unaffected scope.

Tools: scope matrix, normalized event timeline, hypothesis and confidence register

Outcome: Select and document proportionate containment, eradication and recovery actions while preserving evidence and operational safety.

Case: The incident commander must choose between immediate isolation, selective blocking and monitored continuity for a time-critical logistics service.

Tools: containment options paper, remediation tracker, recovery validation plan

Outcome: Investigate cloud, VPN, wireless, email, proxy, IPv6 and encrypted-traffic scenarios using provider-aware and privacy-aware evidence plans.

Case: Netrakshak evidence spans cloud flow logs, VPN authentication, a branch Wi-Fi network, secure email gateways, proxies and mostly encrypted application traffic.

Tools: provider evidence plan, multi-domain correlation worksheet, visibility limitations brief

Outcome: Produce technical and executive incident products, coordinate lawful notifications and handoffs, and turn lessons learned into measurable improvement.

Case: The team must brief leaders, hand evidence to specialists, assess current CERT-In obligations and improve controls without exposing unnecessary personal data.

Tools: incident report set, coordination and notification matrix, after-action improvement register

Outcome: Defend an end-to-end network-forensics and incident-response case for Project Netrakshak using synthetic evidence and documented uncertainty.

Case: A final synthetic evidence drop combines a VPN anomaly, DNS and TLS metadata, Zeek and Suricata records, cloud flows, a packet excerpt, business constraints and conflicting explanations. Learners must defend a safe response.

Tools: integrated case file, executive and technical brief, after-action defence