Describe an alert, entity, or scenario. I will tell you how I would investigate it and which questions I would ask, straight from Command Zero's library.
Try: “How would you investigate a BEC attack?”
Live in under an hour. No migration. Zero training data required.