SOC Training Lab · v2.4

Insider Threat & Web Control Sandbox

Launch insider actions from an authenticated endpoint and observe how SWG inspection, browser isolation and DNS-layer enforcement change the outcome.

Exfiltrated bytes

0 B

Malware ingress blocked

0

DNS bypasses prevented

0

Enterprise Egress Path

○ idle
NODE 1

Insider Endpoint

  • IP 10.0.1.105
  • Authenticated Employee
NODE 2

Internal NGFW

  • DNS Redirector
  • Egress policy 10.0.0.1
NODE 3

SWG Proxy / RBI

  • Inspection proxy :8080
  • Isolation container
NODE 4

DNS Security Layer

  • Umbrella resolver
  • Sinkhole 127.0.0.1
NODE 5

External Web / Cloud

  • drive.google.com
  • 8.8.8.8 · payload host

Insider Action Generator

Client-side scenarios executed as user 10.0.1.105

Scenario A: Data Exfiltration to Personal Cloud

HTTP POST → drive.google.com

payload: Customer_DB_Export.csv

Scenario B: Drive-by Malware Download

HTTP GET → unrated domain

payload: ransomware_payload.exe

Scenario C: Bypassing Corporate DNS (Shadow DNS)

UDP/53 → 8.8.8.8 direct resolver

payload: blocked-site[.]tor-proxy[.]net

Defense & Prevention Controls

Redirect all web traffic to the SWG inspection proxy (10.0.0.8:8080) for header and body inspection.

OFF = ALLOW uploads to Drive/Dropbox. ON = inspect POST bodies and block sensitive data uploads.

Scan downloaded objects against SHA256 reputation and AV engines before delivery.

// no redirection: traffic egresses directly through the NGFW

Inspection Log

0 events

[ waiting ] no traffic captured — execute an insider action to begin packet tracing.