beginnerFree
Suspicious PowerShell
Investigate unusual PowerShell activity and decide whether the behavior warrants escalation.
Available
Start investigationINVESTIGATION LAB
Practice the decisions behind real SOC investigations.
For aspiring and junior SOC analysts. Investigate realistic alerts, follow the evidence, and practice making the final call.
Explore investigations3 free cases · About 10–15 minutes each · No registration
THE CASE LIBRARY
Start investigating
Short, realistic SOC cases designed around investigation decisions rather than multiple-choice answers.
beginnerFree
Suspicious Certutil Decode
Investigate a Certutil decode event and determine what happened to the resulting artifact.
Available
Start investigationbeginnerFree
Potential Password Spraying
Investigate failed network logons across many accounts and two successful sessions.
Available
Start investigationEXPLORE INVESTIGATIONS
Built around the work.
Windows Endpoint
Investigate suspicious process, script, file, and host activity on Windows systems.
3 cases