This warmup case established the operating rhythm for the full Baker221b workshop: read the prompt carefully, determine whether the task belonged in the SQL interface or the terminal, inspect structure before assuming field names, and extract only what the evidence actually supported.

Filed by Enola Holmes. Evidence sources: Azure Activity Logs and a GCP credentials file. All SQL-backed data lived in the warmup table. The terminal exposed supporting filesystem artifacts.

Baker221b platform — SQL interface and case context Case overview and evidence sources

Help Menu and Table Orientation

The opening prompt required interaction with the Help menu before deeper analysis — less about trivia, more about orienting to available datasets and tooling. The third example query listed in the Help section:

SELECT * FROM gcp_flow_logs;
Help menu showing available datasets and example queries

Table Enumeration and Schema Review

Even simple questions should begin with structure awareness. The warmup table was the source of truth for the SQL portion.

SELECT COUNT(*) FROM warmup;

Total records: 50

DESCRIBE warmup;

caller field type: Nullable(String)

DESCRIBE warmup output showing field types COUNT(*) returning 50 records

Earliest-Event Identification

The Azure activity portion required sorting by time and extracting the first operation recorded in the dataset:

SELECT operationName.value
FROM warmup
ORDER BY eventTimestamp ASC
LIMIT 1;

Earliest operation: Microsoft.Authorization/policies/audit/action

Terminal Enumeration

The terminal portion shifted from SQL-backed telemetry to local filesystem awareness:

ls ~
ls -d ~/*/

Non-hidden directories in /home/competitor: 2

ls ~ output showing home directory contents ls -d showing two non-hidden directories Directory count confirmed

Credential Artifact Extraction

The final step was the most important pivot: the answer did not come from the SQL interface at all, but from an endpoint-side artifact in the shell environment. A SQLite database stored in a typical GCP configuration path held the expired credential.

sqlite3 ~/.config/gcloud/credentials.db 'SELECT value FROM credentials;' | jq -r '.client_secret'

Expired GCP client_secret: ZmstLNjJy2198hD4CTg23as3

sqlite3 query against GCP credentials database client_secret extracted via jq Completed warmup case view All warmup answers confirmed

What This Warmup Actually Established

Execution context mattered. The SQL pane and terminal were not interchangeable, and the wrong tool in the wrong place created friction. That distinction became critical once later cases split evidence between cloud telemetry, repository history, and local JSON artifacts.

Schema awareness beat guesswork. Using DESCRIBE before building field assumptions created cleaner, faster pivots — especially useful in the nested structures appearing later in Entra sign-in logs, Unified Audit Logs, CloudTrail, and GCP flow data.

Cloud investigations often mix control-plane evidence with endpoint-like residue. The Azure activity data answered one class of questions while the GCP credential artifact answered another. The warmup demonstrated that real investigations rarely stay inside a single interface.