Hands-on practice for SOC analysts
Investigate real attacks from the CIS region
Labs built on incidents typical of CIS companies: an overnight brute-force against Remote Desktop, a command-and-control channel hiding in traffic, a lookalike domain in mail headers. Logs, connections and mail right in your browser — nothing to install.
Free labs · no install · in English, на русском, қазақша
What you will not find on other platforms
Regional scenarios
Incidents typical of companies in the region: remote access to servers, lookalike domains, mail forged to look internal.
All in the browser
A mini-SIEM, traffic and email analysis on the page itself. Works on a modest laptop.
Three languages
English, Russian and Kazakh — questions, hints and debriefs.
Evidence-based answers
Every answer is a concrete fact from the data: an IP, a path, a command, a timestamp. No guessing.
How a lab works
- 1
Briefing
What happened at the company and what is being asked of you. After that, only data.
- 2
Workspace
Logs, connections and mail with field search. Everything opens in the browser.
- 3
Questions
Every answer is a fact from the data. Checked on the server; hints cost points.
- 4
Debrief
Once you finish: which signals catch this, and what to do about it for real.
Labs · 118
Go to labsAfter Eight
Astana Logistik LLP
An account that always works from the office logged on from outside several times one evening. Describe those logons.
One Admin Too Many
Astana Logistik LLP
In the evening a new account appeared on AL--DC-01, landed in a privileged group and logged on within the hour.
Four Oh Four
Altyn Stroy LLP
The site's daily log holds hundreds of 'not found' responses from a single address. Describe that client.
Night Shift
Astana Logistik LLP
Monitoring flagged a spike of failed logons against AL--SRV-APP overnight. Work out how it ended.
One Big Session
Nur Integrator LLP
In one day a single session carried more out of the network than all the other outbound traffic combined. Find it.
One File, Many Boxes
Altyn Stroy LLP
The same attachment arrived at several company mailboxes from an external address. Measure the reach of the campaign.
Tracks
Endpoint
24 labs in this category, from simplest to hardest.
and 21 more
Network
24 labs in this category, from simplest to hardest.
and 21 more
16 labs in this category, from simplest to hardest.
and 13 more
Threat Hunting
24 labs in this category, from simplest to hardest.
and 21 more
Incident Response
22 labs in this category, from simplest to hardest.
and 19 more
Detection Engineering
8 labs in this category, from simplest to hardest.
and 5 more
Start with a free lab
Two labs are open with no subscription and no card. An account is only needed to save progress.