Available
Cyber Foundations
The starting point before SOC Analyst L1 — what cybersecurity actually protects, and the vocabulary every later module builds on.
Incident Triage
7 / 7 Units · 1 hours
Start learning pathLearn. Investigate. Defend.
Learn Cybersecurity. Practice Like a Professional. Prove Your Skills.
Structured job-role paths, hands-on browser labs, and real investigations — graded on the server, so what you prove is what you actually did.
Cyber Foundations
Digital & Cybersecurity Foundations
How LearnDefend works
One loop, repeated until the skill is real: learn it, test it, apply it, investigate with it, then prove it under pressure.
- 01
Learn
Read structured theory written for practitioners, not for exams.
- 02
Test
Check the concept stuck with a short server-graded knowledge check.
- 03
Practice
Apply it in a browser lab against realistic evidence.
- 04
Investigate
Work a full scenario where nobody tells you what happened.
- 05
Prove
Finish a job simulation that mirrors a real shift.
Learning Paths
Job-role curricula built by LearnDefend.
Available
Networking Fundamentals
Build a working mental model of how computers talk — from a single Ethernet frame to a full HTTPS request across the internet. A core-technology foundation for Cloud, DevOps, Linux, Windows, Security and Data roles alike. Recommended prior knowledge: Cyber Foundations.
Network AnalysisLog Analysis
8 / 8 Units · 20 hours
Start learning pathAvailable
Windows & Active Directory Administration
Build a working mental model of Windows — processes, the registry, users and permissions — then how Active Directory lets one team manage thousands of machines and identities. A core-technology foundation for IT operations, system administration, Cloud, DevOps and Security roles alike. Recommended prior knowledge: Cyber Foundations.
Windows SecurityLog Analysis
8 / 8 Units · 22 hours
Start learning pathAvailable
Scripting & Automation
Build a working mental model of how programs think — data, logic, functions, files — and use it to automate repetitive work reliably. A core-technology foundation for Cloud, DevOps, Data, Programming, AI and Security roles alike. Concepts are language-agnostic, shown mainly in Python. Recommended prior knowledge: Cyber Foundations.
Log AnalysisAnalyst Reporting
8 / 8 Units · 22 hours
Start learning pathAvailable
Linux Administration
Learn practical Linux administration end to end: the shell and filesystem, users and permissions, processes and services, packages, storage, networking and SSH, security hardening, Bash automation, and real production troubleshooting — on a browser workspace with synthetic servers.
Log AnalysisNetwork AnalysisIncident Triage
5 / 5 Units · 16 hours
Start learning pathAvailable
SOC Analyst L1
Learn how modern SOC analysts monitor, investigate, triage and respond to security events — by doing the work, not by memorising definitions.
Network AnalysisWindows SecurityLog AnalysisSIEM OperationIOC Analysis
10 / 10 Units · 120 hours
Start learning pathAvailable
SOC Analyst L2
Step up from Tier-1 triage to Tier-2 depth: correlate across sources, hunt on a hypothesis, engineer and tune detections, and lead complex investigations. Recommended after completing SOC Analyst L1.
Log AnalysisSIEM OperationThreat HuntingDetection EngineeringWindows Security
10 / 10 Units · 140 hours
Start learning pathAvailable
SOC Analyst L3
Own the investigation, not just the alert. Scope an intrusion end to end, correlate across every source, lead a hunt, validate and tune detections without creating blind spots, and make evidence-supported escalation and closure decisions like a senior analyst. Recommended after SOC Analyst L2.
Incident TriageLog AnalysisSIEM OperationThreat HuntingDetection Engineering
5 / 5 Units · 90 hours
Start learning pathAvailable
Incident Response
Move from a confirmed alert into structured response: validate, scope, preserve evidence, contain, eradicate, recover — and report to both engineers and executives. Recommended prior knowledge: Cyber Foundations or SOC Analyst L1.
Incident TriageLog AnalysisWindows SecurityIOC AnalysisAnalyst Reporting
6 / 6 Units · 45 hours
Start learning pathAvailable
Threat Hunting
Proactive, hypothesis-driven investigation — finding attacker behavior the alerts missed, and turning what you find into new detections. Recommended prior knowledge: Cyber Foundations or SOC Analyst L1.
Threat HuntingLog AnalysisWindows SecurityNetwork AnalysisDetection Engineering
6 / 6 Units · 42 hours
Start learning pathAvailable
Threat Intelligence
Turning raw observations into assessed, actionable intelligence — with sourcing, structured analysis, and estimative language a decision-maker can act on. Recommended prior knowledge: Cyber Foundations or SOC Analyst L1.
Threat IntelligenceIOC AnalysisAnalyst ReportingLog AnalysisNetwork Analysis
6 / 6 Units · 40 hours
Start learning pathAvailable
Digital Forensics (DFIR)
Reconstructing what happened from evidence — execution artifacts, registry, event logs, filesystem metadata, memory and network traces — into a defensible timeline and report. Recommended prior knowledge: Cyber Foundations or Incident Response.
Windows SecurityLog AnalysisIOC AnalysisIncident TriageAnalyst Reporting
6 / 6 Units · 44 hours
Start learning pathAvailable
Malware Analysis
Understanding suspicious samples defensively — safe handling, static and dynamic analysis, behavior, persistence, network activity — and turning what a sample DOES into IOCs, ATT&CK mappings and detections. Recommended prior knowledge: Cyber Foundations or Digital Forensics.
IOC AnalysisWindows SecurityNetwork AnalysisDetection EngineeringAnalyst Reporting
6 / 6 Units · 42 hours
Start learning pathAvailable
Detection Engineering
Turning attacker behavior and telemetry into high-quality, maintainable detections — from requirements and data quality through detection logic, testing, false-positive tuning, coverage and production readiness. Tool-neutral (Sigma-style logic). Recommended prior knowledge: SOC, Threat Hunting or Malware Analysis.
Detection EngineeringSIEM OperationLog AnalysisWindows SecurityNetwork Analysis
6 / 6 Units · 42 hours
Start learning pathAvailable
Endpoint Security
Defending endpoints end to end — architecture and attack surface, telemetry and EDR, process-lineage investigation, containment decisions, and hardening. Where telemetry, detection, forensics and response meet the real host. Recommended prior knowledge: Cyber Foundations, SOC or Detection Engineering.
Windows SecurityLog AnalysisIOC AnalysisIncident TriageNetwork Analysis
6 / 6 Units · 42 hours
Start learning pathFeatured Labs
Hands-on practice you can start right now.
Easy
Where Does This Packet Go?
A Meridian workstation is configured 192.168.10.25 / 255.255.255.0 (a /24), gateway 192.168.10.1. For each destination it wants to reach, you must decide — from the addressing alone — whether the packet is delivered locally or handed to the gateway, and then diagnose why one destination is unexpectedly failing.
20 min
Medium
The Layered Troubleshoot
Three Meridian users each report 'I can't reach the reporting site'. You have each machine's diagnostics. Apply the bottom-up method — address, gateway, DNS, route, port — and name, for each case, the first failing layer and the fix. The three failures are at different layers; do not assume they share a cause.
22 min
Medium
Boss Lab: Read the Capture
Meridian reports intermittent 'suspicious network activity' and hands you an hour of captured traffic from one office segment, summarised as conversations plus the DNS log. The capture is mostly normal — DNS lookups, web browsing, internal ARP, ICMP, healthy TCP handshakes — with ONE communication pattern that does not belong. Investigate it the way lesson 8.3 taught: filter, group, compare, and reach an evidence-based conclusion. Claim only what the packets support.
32 min
Medium
Who Can Read the Salaries?
Aldar's HR keeps confidential salary files on the share \\FS-01\HR. A review asks you to work out, from the ACL and group memberships alone, exactly who can reach that data and to find any over-broad grant. Claim only what the permissions actually show — access can arrive through a group, and an explicit Deny can override an Allow.
26 min
Medium
Reading the Logon Trail
Aldar's Security log shows the day's logons for several accounts. Using logon type and source — not just the account name — work out which activity is routine and which one entry doesn't fit the account's role. Read account + type + source + time together.
24 min
Medium
Boss Lab: The Server That Won't Behave
Aldar's application server SRV-APP07 started misbehaving this morning: a key service keeps failing, and something looks off in its autostart configuration. You have the System log, the Security log, and an autostart/process snapshot. Apply the troubleshooting method — scope, localize, read the evidence, find the earliest cause — and reach an evidence-based conclusion about what happened and what to fix. Claim only what the evidence supports.
34 min
Easy
Trace the Loop, Find the Bug
Orbit has a short script meant to sum a list of daily sales, but it prints the wrong total. Read the code as the interpreter would — line by line, tracking state — predict what it actually prints, identify the bug, and give the fix and the corrected result. Reason from the code, not from what it was 'supposed' to do.
20 min
Medium
Why the Total Came Out Wrong
Orbit reads amounts from a data file and sums them, but the result is nonsense. Read the data and the code together, work out what type the values really are, predict the buggy output, and give the fix. This is the everyday reality of parsing real files.
22 min
Medium
Boss Lab: Verify the Pipeline
Orbit's per-region sales pipeline runs with no errors and prints a plausible report — but is it correct? You have the pipeline code and a small test input whose answer you can compute by hand. Work out the correct output, predict what the pipeline actually produces, locate the stage with the bug, give the fix, and reason about an edge case. Prove correctness — don't assume it because it ran.
32 min
Easy
Files, Users & Permissions
A web app on a Jisr server cannot read its config, and a private key looks wrong. Read the ownership and permission bits and fix the access without weakening security.
15 min
Medium
Services, Networking & Logs
The web service on a Jisr server is down. Use the service state, the listening sockets and the journal to find the cause — one process is holding the port.
16 min
Medium
Troubleshoot a Linux Server
A Jisr application server is slow and its nightly job did not run. Use performance tools, systemd and logs to localize the bottleneck and the failed job — evidence, not guesses.
18 min
Hard
Path Exam — Secure & Fix a Production Server
A small Jisr production Linux server has several operational and security misconfigurations at once. Review the evidence and identify the corrective actions across permissions, service state, network exposure, logs and a failed scheduled job. Reason from the evidence — this is the capstone of the path.
26 min
Beginner
Know What You Protect
Aurora Dates Trading Co. has never kept a proper asset inventory. The new IT lead hands you a network scan and a half-finished asset sheet and asks: what do we actually own, which asset would hurt most if lost, and is anything on the network that nobody is managing?
20 min
Beginner
What Is Listening?
Aurora's firewall was configured years ago and never reviewed. You are given the current inbound rule set and a connection snapshot from the edge. Identify what each rule actually exposes, and find the one exposure that should never face the internet.
20 min
Easy
The Process That Should Not Be
Endpoint protection on WS-07 — the finance manager's workstation at Aurora — flagged 'unusual child process' and captured a process snapshot plus a connection list, then auto-closed the alert as low severity. Review the evidence yourself and decide whether the auto-close was right.
25 min
Easy
One Password, Many Doors
Aurora's identity provider logged a burst of failed sign-ins overnight. The IT lead wants three answers before the morning stand-up: what attack pattern is this, did any account actually fall, and did MFA do its job anywhere?
25 min
Easy
Two Emails, One Verdict Each
Two employees forwarded emails to Aurora's new 'report suspicious mail' address within an hour of each other. Triage both. One deserves an incident; treating the other as one would teach staff that reporting mail is a waste of time.
25 min
Easy
The Alert That Cried Wolf
Aurora's new SIEM fired 'Service account interactive burst — possible abuse' at 02:00, for the third night running. The on-call engineer is tired of it. Triage the alert properly: validate it against context before you decide, and recommend what should happen to the rule.
20 min
Easy
Scope the Marasi Intrusion
You are the responder on the Marasi svc-fleet incident. Validation is done; now you must scope it. You have the service account's authentication log and the map of what that account can reach. Separate confirmed scope from the blast radius that still needs checking.
25 min
Medium
The Containment Board
Three items land on your containment board during the Marasi response. Two are attacker footholds needing action; one is a legitimate emergency change a panicking admin made that LOOKS hostile. Contain what must be contained — and do not take down the business over a false alarm.
25 min
Medium
Reconstruct the Movement
Lateral movement is suspected in a fresh Marasi incident. From authentication and endpoint evidence, reconstruct where the attacker went, in what order, and where they stopped. Bound the scope with evidence — including the boundary a failed attempt provides.
30 min
Medium
Hunt the Qasr Finance Endpoint
Intelligence describes a campaign that delivers macro documents to finance staff. You are hunting Qasr's finance workstations with a hypothesis: an office document spawned a shell chain and established persistence. You have process-creation telemetry and a scheduled-task export. Read the lineage — do not judge by process name.
30 min
Medium
The Anomaly That Wasn't
Your hunt flagged three anomalies on Qasr's servers this week. Leadership wants to know if Qasr is breached. Your job is NOT to find a breach — it is to reach the honest verdict. Investigate each anomaly against the baseline and change records. Not every hunt ends in compromise, and calling a benign event an incident is its own failure.
28 min
Hard
Trace the Qasr Beacon
A threat-informed hunt looks for C2 beaconing on Qasr's network. You have aggregated outbound connection data and authentication logs. Separate real beaconing from legitimate periodic traffic, then pivot to establish the full scope response will need.
32 min
Medium
Grade the Sources
Four inputs about a possible threat to Sahab's billing portal land on your desk. Before any of it becomes intelligence, apply sourcing discipline: grade reliability and credibility, and spot the reports that are only echoing one original.
28 min
Medium
The Breach That Wasn't
A forum post claims Sahab's entire customer database is for sale, and leadership is alarmed. Your job is to assess the claim honestly, not to confirm it. Apply structured analysis to the 'evidence' offered. Sometimes the correct, valuable intelligence product is: this claim is not credible.
28 min
Hard
Profile the Adversary
A confirmed intrusion set targets Sahab. Build an adversary profile: map the behavior to ATT&CK, pivot the shared infrastructure with the Diamond Model to find related activity, and prioritize what to deliver using the Pyramid of Pain.
32 min
Medium
The Vanished Executable
A suspicious tool was reported on Wadi Logistics workstation WD-OPS-04, but the file is no longer on disk. You have a Prefetch parse, an Amcache excerpt and the account's browser/shell history. Establish what ran, when, its identity, and where it came from — and claim only what each artifact supports.
30 min
Medium
The Persistence Sweep
After an intrusion on Wadi server WD-APP-02, you must find every mechanism the attacker planted to survive a reboot. You have an autostart sweep (registry + services + tasks) and the Security event log. The eradication plan will contain exactly what you find — miss one and the incident restarts.
30 min
Medium
The Accusation That Failed
HR believes a departing Wadi employee, n.rashid, mass-deleted project files and copied them to USB on their last day. You have the MFT/USN record, the LNK evidence and the change calendar. Your job is NOT to confirm the accusation — it is to reconstruct what actually happened. A forensic analyst clears people as often as they implicate them.
28 min
Medium
Static Triage of a Suspicious Attachment
Badr Engineering's mail filter quarantined an attachment named quote.pdf. You have its static analysis output only — magic bytes, hashes, strings, imports and the PE section table. Without ever running it, decide what it really is and what it is capable of. Claim only what static evidence supports.
28 min
Medium
The Sample That Wasn't Malware
An EDR alert flagged bkupagent.exe on a Badr server as 'suspicious'. The SOC wants a malware verdict. You have the sandbox behavior report, the file's signature status and the change records. Your job is the honest verdict — a suspicious-looking sample is not the same as a malicious one, and calling benign software malware has its own cost.
26 min
Medium
From Behavior to Detection
You have finished detonating a confirmed-malicious Badr sample and captured its behavior report and network trace. Now turn the analysis into defensive value: extract the durable IOCs, map the behavior to ATT&CK, and choose the behavior worth handing to detection engineering. Prefer what survives infrastructure rotation.
28 min
Medium
Build a Durable Detection
Jisr Bank confirmed an intrusion: a phishing document spawned encoded PowerShell that dropped and persisted an implant. You have the incident's process telemetry and the available fields. Design a detection that catches this behavior durably — not one tied to the specific hash or IP that the attacker will rotate.
30 min
Medium
The Rule That Cried Wolf
A Jisr detection fires 180 times a day, and the SOC has started auto-closing it. Leadership asks whether the bank is under sustained attack. Your job is NOT to escalate an incident — it is to determine the truth. Analyze the alerts against the baseline and change records, and reach the honest verdict. A flood of alerts on legitimate activity is a tuning problem, not a breach.
26 min
Medium
Validate the Detection
A Jisr detection for DNS-tunneling exfiltration is ready for review. Before it ships, you must validate it against labeled fixtures — malicious cases it must catch and benign cases it must ignore — and measure whether it is production-ready. Firing on the attack is only half the test.
28 min
Medium
Trace the Fanar Endpoint
An EDR alert fired on powershell.exe on Fanar Hotels workstation FANAR-FD-02. You have the process tree, authentication events and the account context. Run the investigation loop: trace the lineage up to the root cause and down to the impact, establish the identity scope, and review persistence. Read lineage and command lines, not process names.
30 min
Medium
The Alert That Wasn't
An EDR alert fired on FANAR-IT-05: 'PsExec used to run a process on a remote host'. The SOC wants to know if an attacker is moving laterally. Your job is NOT to declare an incident — it is to reach the honest verdict. Investigate the alert against the identity context and change records. Not every EDR alert is an attack, and isolating a production host over a false positive has its own cost.
26 min
Medium
The Containment Call
A Fanar Hotels host is confirmed compromised: a partly-fileless implant is beaconing to C2, a domain-admin credential was exposed, and lateral movement to an internal server has begun. Leadership wants it 'shut down now'. Your job is to choose the right containment sequence — one that stops the spread, preserves evidence, and addresses every part of the intrusion.
28 min
Easy
The Midnight Login
It is 02:40 on a Saturday at Nexa Digital. An alert fires on SRV-FIN-02, a finance file server. The rule that triggered is 'Multiple failed logons followed by success'. Nobody from the finance team is scheduled to work tonight. You have the server's authentication log and the account directory.
25 min
Easy
The 03:00 Sweep
An alert fires at Nexa Digital: 'Host contacting unusually large number of internal systems'. The source is 10.20.7.9, which reached 214 internal hosts in eleven minutes. The pattern resembles internal reconnaissance. Determine whether it is.
20 min
Medium
Challenge: Three Alerts, One Shift
You have taken over the Nexa Digital queue at 09:00. Three alerts fired overnight and nobody has touched them. The outgoing analyst left no notes. Two of these alerts describe parts of the same activity. One is unrelated. Work out which is which, and decide what the shift lead needs to know.
35 min
Medium
Module 01 Assessment — Part B: The Recurring Lockout
An employee has reported being locked out four times this week. The service desk escalated it to the SOC as possible account attack. Three explanations are consistent with a repeated lockout: an attacker guessing the password, a stale credential cached on a device, or the user mistyping. Decide which the evidence actually supports.
30 min
Easy
Reading the Perimeter Log
You have one hour of firewall records from the Nexa Digital perimeter. Nothing has alerted. Your shift lead wants to know whether anything in this window deserves a ticket. Read the evidence and answer precisely.
20 min
Medium
Two Hosts, One Problem
Two workstations were flagged by a weekly review for unusual DNS volume. Only one of them is actually a problem. You have the DNS records for both. Decide which host needs a ticket, and be able to say why the other does not.
30 min
Easy
Password Spraying Against the Domain
Overnight, authentication failures across the domain rose from a typical 40 to just over 900. No single account was locked out, which is why nobody was paged. The morning shift has asked you to establish whether this was an attack and, if so, whether it succeeded.
20 min
Medium
Four Services, One Problem
An EDR alert fired on WS-118 for 'unsigned binary registered as a service'. Four services were installed on this host in the last 24 hours. Three of them are routine. Your job is to say which is not, and to prove it from the evidence rather than from the name.
22 min
Medium
Three Clocks, One Incident
An intrusion is confirmed on WS-090 and your job is the timeline. The catch: the domain controller logs in UTC, the workstation logs in UTC+3, and the cloud mail service logs in UTC-5. Get the order wrong and the report will claim the response happened before the attack.
20 min
Medium
Three Sources, One Aggregation
It is a normal shift and your SIEM dashboard shows three summaries: failed logins by source, outbound connections by destination, and a data-transfer view. Nothing here is a raw event — your job is to read the aggregations correctly and decide which rows are noise, which is a spray, and which is a beacon. Reading count without its second dimension is the trap the whole lab is built around.
18 min
Medium
Triage the Indicator Set
An EDR alert on WS-114 produced a batch of indicators, and a threat-intel feed match arrived at the same time. Your job is not to block everything — it is to decide which indicator is worth acting on, which is a shared service you must not block, and which single indicator to pivot on to scope the incident. Enrichment and local telemetry are provided.
20 min
Medium
Behaviour Over Content: Beacon, Tunnel, Exfil
An NDR flagged 'unusual outbound activity' on the 10.20.4.0/24 subnet. There is no full PCAP — only flow records, a DNS aggregation, and TLS metadata. Read behaviour, not content: find the beacon, the DNS tunnel and the exfiltration, decide which single host is compromised, and map what you found to MITRE ATT&CK. Encryption hides payloads here; it does not hide the shapes.
20 min
Medium
Tune a Noisy Detection Without Going Blind
A password-spray detection is firing so often that analysts have started ignoring it — and a real spray may be hiding in the noise. Here is the rule and the three sources it fired on this hour, with context. Your job is detection work, not just triage: find the true positive, find the benign cause of the noise, choose the tuning that silences the noise without losing the attack, confirm the tuned rule still fires on the spray, and map it to ATT&CK.
20 min
Medium
First Moves on a Confirmed Incident
EDR has CONFIRMED a compromise on WS-042: a finance user clicked a phishing link, PowerShell ran, and the host is beaconing to an external controller right now. The user has access to the payment system. The incident is real — your job is the first moves. Make each response decision in the right order: what to preserve, how to contain without destroying evidence, what NOT to do yet, and how urgently to escalate.
20 min
Medium
The Integrated Shift: One Incident, Every Pillar
It is your shift. A single alert — a failed-login spike — is at the top of the queue, and it is about to become a full incident. Walk it end to end: read the SIEM aggregation to find the host, follow the network to what it is talking to, assess the destination, and decide the response. Each step is a different question answered by a different source; hold the thread from the first alert to the final decision.
22 min
Medium
Correlating a Multi-Source Intrusion
Tier-1 escalated an alert they could not close: a successful logon that looked routine. You have four sources for the same window — an authentication summary, a SIEM detection, an endpoint chain and outbound network flows. Read them together, not one at a time.
20 min
Hard
Module 1 Assessment — Part B: Correlate and Decide
A fresh case, no Tier-1 notes. Three sources cover one window on a database server. Correlate them, judge whether the order is even possible, and decide.
22 min
Hard
Hunting a Scheduled-Task Persistence Hypothesis
Your hypothesis: 'A non-admin account created a scheduled task from a user-writable path in the last 7 days — possible persistence (ATT&CK T1053.005).' You pulled every Event 4698 (task creation) for the window. Work the hypothesis: pivot, rule out the benign explanation, judge confidence, and decide.
22 min
Hard
Module 2 Assessment — Part B: Hunt a Beaconing Hypothesis
Hypothesis: 'A host is beaconing to command-and-control at a fixed sub-5-minute interval to a rare external destination.' You have outbound-flow summaries and enrichment for the window. Hunt it: pivot, rule out the benign update-check explanation, judge confidence, decide.
22 min
Hard
Deep-Dive a Compromised Workstation
An EDR alert flagged 'unusual process on FIN-WS-09'. Tier-1 could not tell attacker from admin. You have the host's process telemetry, its persistence-creation events, and its logon record. Read the host deeply and reconstruct what happened.
22 min
Hard
Module 3 Assessment — Part B: Read the Host and Decide
A fresh host case. You have process telemetry, a persistence entry and a logon record for SRV-APP-05. Read the ancestry, triage the persistence, and decide the response.
22 min
Hard
Trace a Beacon Across the Wire
A proxy anomaly flagged repeated outbound connections from the finance segment. You have the NetFlow records, the TLS metadata, and the endpoint-to-connection mapping. Find the command-and-control channel and name the host that owns it.
22 min
Hard
Module 4 Assessment — Part B: Trace the Traffic and Decide
A fresh network case on host SRV-DB-04. You have its outbound flows, the destination context, and the host's data-access role. Read the traffic, rule out the benign twin, and decide the response.
22 min
Hard
Triage a Sample From Its Behaviour
A user opened invoice.pdf.exe and your EDR quarantined it, but the static scan says 'no detection'. You have the synthetic detonation report — the actions the sample took when run in an isolated environment. Read the behaviour, extract the indicators, and triage it.
22 min
Hard
Module 5 Assessment — Part B: Triage and Decide
A fresh sample detonated from HR-WS-14. You have its synthetic detonation report and the host context. Read the behaviour, extract the indicator to scope with, classify it, and decide the response.
22 min
Hard
Turn an Alert Into Intelligence
An alert fired on a finance workstation that opened an invoice-lure attachment and then beaconed out. Your CTI platform enriches the indicators against a synthetic actor profile. Read the enrichment, judge the attribution, and decide the next action.
22 min
Hard
Module 6 Assessment — Part B: Prioritise and Act on Intelligence
You hold one priority intelligence requirement (PIR) and a limited budget of attention. Several intelligence items arrive at different reliability levels. Classify, filter, and turn the right one into an action.
22 min
Hard
Engineer a Detection From a Confirmed TTP
Threat intelligence handed you a confirmed TTP: an Office application spawning an encoded PowerShell child. A junior analyst drafted a rule that alerts on all PowerShell. You have the TTP, the draft rule, a real attack event and a sample of benign activity. Turn the draft into a detection you can trust.
22 min
Hard
Module 7 Assessment — Part B: Diagnose and Tune a Detection
You inherit a noisy detection and a set of complaints. Diagnose its weaknesses, apply the right tuning, make it durable, and decide how to keep it working over time.
22 min
Hard
Hunt a Living-off-the-Land Execution at Scale
No alert fired, but intelligence says an actor executes payloads via living-off-the-land binaries your rules don't cover. Your hypothesis: an Office app should never spawn a scripting host. You have millions of process-creation events aggregated by parent-child pair. Hunt the gap.
22 min
Hard
Module 8 Assessment — Part B: Run an Anomaly Hunt to Its Close
You have a baseline of how the finance team's accounts normally authenticate. Intelligence suggests credential misuse. Hunt for the account or host that deviates from its peers, then close the loop.
22 min
Hard
Run the Incident From Escalation to Closure
Module 8's hunt escalated a live intrusion: WINWORD spawned mshta.exe on FIN-WS-12, which is beaconing to C2 now, and the same foothold appears on other hosts. You are the incident responder. Drive the lifecycle without destroying evidence or leaving the attacker a way back.
22 min
Hard
Module 9 Assessment — Part B: Command the Incident
Ransomware is encrypting files on a live host and spreading to a file share; a domain credential is exposed and scoping shows more affected hosts. You are the incident commander. Take the right actions in the right order, and close the incident properly.
22 min
Hard
Run One Case Through the Whole Workflow
A single alert lands on a busy shift: an unusual process on FIN-WS-12, one event, no rule matched the full pattern. Take it through the integrated SOC workflow — correlate, hunt, respond, and close the loop — while a full queue waits behind it.
22 min
Hard
Module 10 Assessment — Part B: Operate the Floor
You are the analyst on a busy shift with a full queue. Prioritise, run the top case through the workflow, and hand over cleanly at shift end.
22 min
Easy
Filter to the Truth
An alert at Jisr Bank flags 'authentication anomalies' overnight. You are handed a slice of the auth sourcetype in Splunk. Millions of events, one question at a time: use field filters and boolean logic to isolate which account was actually taken over — not merely which had noise.
18 min
Medium
Spray or Brute Force?
Two sources are hammering Jisr's VPN portal. Leadership wants a name for what is happening before they choose a response — blocking one source, resetting one account, or forcing a org-wide reset are very different actions. Use stats to let the numbers classify the technique. Do not guess from the word 'failure'.
22 min
Medium
The Steady Heartbeat
A Jisr workstation is talking to an unfamiliar domain. The traffic volume is tiny, so it never tripped a bandwidth alert — but something about the rhythm looks wrong. Use timechart to decide whether this is a human browsing or a machine calling home.
20 min
Medium
Ten Minutes to a Verdict
A single alert — 'foreign login, j.rai' — lands in your queue. On its own it means little. You pull auth, endpoint and proxy events for that user into one timeline. Your job is a defensible verdict: is this an incident, and if so, what is the evidence chain? Do not escalate on one scary line, and do not dismiss a real chain because each link looks small.
26 min
Easy
Write the Query
Jisr Bank's Elastic Security flags overnight authentication anomalies. You are in Discover on the auth data view. Use KQL — field:value and boolean logic, not free text — to isolate which account was actually taken over, and prove it from the fields.
18 min
Medium
Aggregate the Answer
Two sources are hammering Jisr's VPN portal. Before leadership chooses a response, name the technique from the aggregation, not the word 'failure'. You have an Elastic aggregation of failed logins split by source.ip, with both a count and a unique count of user.name.
20 min
Medium
Correlate on the Timeline
An Elastic Security alert — 'foreign login, j.rai' — lands in your queue. Alone it means little. You pull auth, endpoint and proxy events for that identity onto the Timeline. Reach a defensible verdict: is this an incident, and what is the evidence chain? Do not escalate on one alert, and do not dismiss a real chain because each link looks small.
26 min
Easy
The Service That Shouldn't Be There
You scanned the Jisr user VLAN (10.20.4.0/24) before a change. Most hosts look normal, but one exposes a service that has no business on a user segment. Find it and say why.
16 min
Easy
Open, Closed, or a Wall?
A single host returned a mix of port states. Leadership asks whether a service is exposed. Read the states correctly — one of them means a firewall, not an absent service.
14 min
Medium
Prioritize the Exposure
A version scan of a DMZ host returned several services. Pick the one that most needs action and write the conclusion — the version, not the open state, decides.
16 min
Easy
Follow the Lineage
An alert fired on encoded PowerShell on FIN-07. You have the Sysmon Event ID 1 (process create) excerpt. Trace the lineage and name the malicious parent that started the chain.
15 min
Medium
One GUID, the Whole Action
You have a mix of Sysmon events correlated by ProcessGuid for one process. Reconstruct what it did: where it connected and what persistence it installed.
18 min
Medium
Signal or Noise?
Two process chains fired similar-looking events. One is a benign admin tool; the other is an intrusion. Use lineage and context to tell them apart — not every PowerShell is an attack.
16 min
Easy
Authentication Investigation
Overnight Security-log events from a Jisr host. Determine which account was brute-forced into and how the attacker connected.
15 min
Medium
Account & Privilege Investigation
After a suspected compromise, review account-management events on a Jisr domain controller. Find the persistence the attacker created.
16 min
Hard
Windows Incident Timeline (Exam)
Multiple Windows events span one account across two hosts. Build the timeline and answer who, where, whether it succeeded, and what the attacker did to cover tracks. This is the academy's final assessment.
22 min
Medium
Build a Process Detection
A confirmed intrusion spawned encoded PowerShell from a Word document. Choose the selection that catches this behaviour durably — not the attacker's specific hash or IP.
15 min
Medium
Detect Suspicious Authentication
You need a Sigma rule for password spraying (one source, many accounts, failed logons). Choose the correct logsource and the field pattern that captures the behaviour.
15 min
Hard
Tune a Noisy Detection (Exam)
A Sigma rule for encoded PowerShell fires 180 times a day and the SOC auto-closes it. Determine the benign cause and the disciplined fix — the rule should keep catching attacks, not be deleted. This is the academy's final assessment.
20 min
Easy
Your First YARA Rule
You extracted the strings from a safe synthetic sample. Choose the patterns and condition that would classify this family durably.
15 min
Medium
Reduce False Positives
A candidate YARA rule matches the target sample but also several legitimate installers. Identify why and how to fix it — without losing the true detection.
15 min
Hard
Artifact Classification (Exam)
Three safe synthetic files: two are the target family, one is a benign lookalike that shares a common string. Design the rule that catches the family and rejects the benign file, and justify it. This is the academy's final assessment.
20 min
Easy
Decode the Evidence
A suspicious log field holds an encoded value. Identify the encoding, read the decoded indicator, and prepare it for the report — safely.
14 min
Hard
Multi-Layer Transformation (Exam)
A payload field is obfuscated in several layers. Follow the transformation chain step by step, identify each layer from the intermediate output, and recover the final indicator. This is the academy's final challenge.
18 min