Guided demo
See how a GraphLattice Range scenario works
A short guided tour over a simulated scenario: the incident-response loop, the decisions you make, and how those decisions are scored. Press start and follow along.
Guided walkthrough · simulated scenario
criticalOkta support HAR session-token theft to admin tenant takeover
DetectionContainmentEradicationForensicsRecovery
Containment · 500 pts
A hijacked admin session is taking privileged actions. What is the correct immediate containment?
A. Reset the admin password
B. Revoke all admin sessions, force phishing-resistant reauth, review the System Log
C. Block the source IP at the firewall