> For the complete documentation index, see [llms.txt](https://2dam-7.gitbook.io/window-auth/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://2dam-7.gitbook.io/window-auth/readme.md).

# Overview

This documentation is the reviewer-facing guide for a defensive, synthetic Windows authentication detection lab. It is designed to be published through GitBook while the source of truth stays in this GitHub repository.

> Synthetic lab only. No production logs, credentials, malware, offensive simulations or host-changing automation are included.

## Start Here

* Open the public mini-SOC demo: <https://rubenasuasoto.github.io/windows-authentication-detection-lab/reports/latest/demo.html>
* Read the public GitBook documentation and playbooks: <https://2dam-7.gitbook.io/window-auth/>
* Or open the local mini-SOC demo with `uv run authlab demo --open`.
* Review the five detections in [Detection catalog](/window-auth/detection_catalog.md).
* Walk through analyst response steps in [Playbooks](/window-auth/playbooks.md).
* Check validation results in [Validation](/window-auth/validation.md).
* Use [Reviewer guide](/window-auth/reviewer_guide.md) for a short reviewer walkthrough.

## Reviewer Flow

1. Open the demo and select `AUTH-003-POS`.
2. Compare expected and observed results for the synthetic event sequence.
3. Open the GitBook playbook and explain what an analyst would check next.
4. Open the validation documentation to show pass/fail evidence and limitations.
5. Close by stating that the lab is synthetic and not a production SIEM.

## Detection Coverage

| ID       | Focus                                       | Analyst entry point                                                    |
| -------- | ------------------------------------------- | ---------------------------------------------------------------------- |
| AUTH-001 | Failed logon burst from one source          | [Playbook](/window-auth/playbooks/auth-001_failed_logon_burst.md)      |
| AUTH-002 | Failed logons across multiple accounts      | [Playbook](/window-auth/playbooks/auth-002_multiple_accounts.md)       |
| AUTH-003 | Successful logon after repeated failures    | [Playbook](/window-auth/playbooks/auth-003_success_after_failures.md)  |
| AUTH-004 | Account lockout burst                       | [Playbook](/window-auth/playbooks/auth-004_account_lockout_burst.md)   |
| AUTH-005 | Remote logon followed by special privileges | [Playbook](/window-auth/playbooks/auth-005_privileged_remote_logon.md) |

## Public Demo Status

The GitHub Pages demo is live and should be the first stop for external reviewers:

<https://rubenasuasoto.github.io/windows-authentication-detection-lab/reports/latest/demo.html>

GitBook is intended for polished documentation and playbook review. It does not replace the local demo, validation commands or CI evidence.

Public GitBook URL:

<https://2dam-7.gitbook.io/window-auth/>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://2dam-7.gitbook.io/window-auth/readme.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.