Hands-on
Labs
Practise the daily work of a security operations team on invented data: watch a simulated network, sort alerts, search logs and map what you can detect. Nothing leaves your browser.
Runs locallyInvented data. Progress is kept only in this browser.
Simulation. Not real attack data.
Operations board
The security operations centre (SOC) screen of Kuzey Lojistik A.Ş., an invented logistics company. Ordinary traffic and everyday attack noise run in the background. Start a scenario and an incident unfolds step by step on top of that noise, with what a defender should do at each step.
Simulated time--:--:--Paused
The board needs JavaScript. The explanations below are readable without it.
Indicators
- Events / min–last simulated minute
- Open alerts–detected or awaiting triage
- Blocked–share of events, last 10 min
- Mean time to detect–MTTD, events not blocked
- Mean time to respond–MTTR, alerts closed
- Most targeted–events, last 10 min
- Normal flows / min–connections that raised nothing
Network map
- Ordinary traffic
- Blocked
- Detected
- Awaiting triage
- Scenario path
Select a node to see its role, its recent events and the controls that protect it.
Node
- Role
- Address
Controls that protect it
Recent events
Event feed
No events match the filter. Widen it or start a scenario.
Scenario progress
No scenario running. Pick one above and start it; the steps appear here as they happen.
Breakdowns, last 10 simulated minutes
By outcome
By ATT&CK tactic
By event type
Source location label
Drawn at random on purpose. An IP address's country says little about who is behind it.
How to read live attack maps
- A vendor's map does not show all attacks. It shows a sample of what that vendor's own sensors, products and honeypots detected: one map may draw only what its antivirus, mail filter or intrusion detection found.
- Many maps are not live: they replay recorded events, and some reset every day.
- An arrow shows where traffic was seen, not who attacked. The source address often belongs to a hijacked home device, a rented server, a VPN or a member of a botnet.
- IP location is unreliable. Geolocation databases estimate where an address is registered and are often wrong. On this board the country codes are random labels on purpose; defenders use reputation lists and behaviour rules rather than country blocks.
- For an organisation's own SOC the useful map is its own network, not the globe: which asset was hit, what was blocked, what is still waiting for someone to look at it. This board simulates that view.
Sources
How this simulation works
- Each step is 10 simulated seconds; at 1x a step takes 0.8 seconds. The indicators and breakdowns cover the last 10 simulated minutes.
- MTTD is the mean time between the malicious action and the alert, counted over events that were not blocked. MTTR is the mean time from the alert to its closure.
- On a busy day there are about three times as many events and, because the analyst queue grows, alerts close later.
- You can close alerts yourself from the feed. If you do not, the simulated analyst closes them after a while; scenario alerts stay open until the scenario ends.
- Background events come from a fixed seed, so Reset replays the same stream. Nothing is sent anywhere.
The labs
01
SOC desk: alert triage
Work a queue of security alerts like an analyst: read the logs, the process tree and the message, decide whether each alert is real, map it to ATT&CK and choose the response.
02
Log hunt: query the records
Search a day of invented sign-in, mailbox, web, DNS, proxy and process logs with a SIEM-style query language, then answer the questions of six missions from what you find.
03
ATT&CK map: techniques and detection coverage
Browse the MITRE ATT&CK Enterprise matrix, see what each technique looks like in logs and what stops it, mark your detection coverage, export it as a Navigator layer and walk through attack chains.
Every lab uses invented data and simulates defence work only. Do not test systems you do not own or have written permission to test: unlawful access to an information system is an offence (Turkish Penal Code art. 243).