Lab
SOC desk: alert triage
Work a queue of security alerts like an analyst: read the logs, the process tree and the message, decide whether each alert is real, map it to ATT&CK and choose the response.
Runs locallyInvented data. Progress is kept only in this browser.
Alert desk: Kuzey Lojistik A.Ş.
SimulationSimulated data: invented company, people, addresses and logs.
How the shift works
- Pick an alert from the queue. Its clock starts and it moves to In progress.
- Read the summary, logs, process tree, message or network evidence and the context. Mark the log lines your decision rests on.
- Decide: true or false positive, the ATT&CK technique and the response. Write a short analyst note.
- The result card shows the score and why. When every alert of a level is closed, the shift report and the .txt incident report appear.
Scoring per alert: verdict 40, technique 20, response 30, evidence 10. Each playbook hint costs 3 points.
Company documents: Kuzey Lojistik A.Ş.
Kuzey Lojistik is an invented freight and warehousing company with its head office in Istanbul and a warehouse in Gebze. Read these pages before you judge an alert: many false positives are explained by a change record, an approved tool or a person's normal working pattern.
Network and key assets
| Name | Address | Role |
|---|---|---|
| KL-SRV-DC01 | 10.20.1.10 | Domain controller |
| KL-SRV-FS02 | 10.20.1.21 | File server |
| KL-SRV-SQL01 | 10.20.1.22 | Database (tracking portal, ERP) |
| KL-SRV-BK01 | 10.20.1.23 | Backup server |
| KL-SRV-DAG01 | 10.20.1.25 | Software deployment and patching |
| KL-SRV-MGMT01 | 10.20.1.30 | Management server: the only place admin accounts may sign in from |
| KL-SCAN-01 | 10.20.1.40 | Vulnerability scanner (IT Security) |
| KL-WEB-01 | 192.168.50.10 | Shipment tracking portal in the DMZ, takip.kuzeylojistik.example |
| KL-VPN-GW01 | vpn.kuzeylojistik.example | VPN gateway; client pool 10.20.200.0/24 |
| Workstations | 10.20.4.0/22 | Office and warehouse computers |
| Internet egress (Istanbul) | 203.0.113.10 | All office traffic leaves from here |
| Cloud VPN egress (Frankfurt) | 203.0.113.200 | Traffic of field staff on the cloud VPN |
Change and event calendar, November 2026
| Record | What | When | Owner |
|---|---|---|---|
| CHG-2026-1184 | Weekly DMZ vulnerability scan from KL-SCAN-01 | Every Tuesday 22:00–02:00 | Deniz Yılmaz |
| KL-OLT-2026-11 | November phishing exercise; sender domain bilgilendirme-portali.example, sending service 192.0.2.140 | 3 November, 09:30 | Deniz Yılmaz |
| CHG-2026-1201 | KuzeyRota 4.2 rollout to 60 workstations | 3 November, 12:30–13:30 | Murat Kaya |
| CHG-2026-1192 | Clean-up of the temporary share on KL-SRV-FS02 | 4 November, 10:00–12:00 | Murat Kaya |
| CHG-2026-1207 | Move of the 2021–2025 accounting archive to the corporate cloud tenant | 5–6 November | Gizem Tunç |
| HUK-2026-031 | Export of Gebze warehouse camera footage at a law-enforcement request | 5 November | Emre Yıldız |
| CHG-2026-1210 | November patch night for servers (remote service method) | 5 November, 23:00–03:00 | IT infrastructure on-call |
People and working patterns
| Name | Role | Account | Normal pattern |
|---|---|---|---|
| Ayşe Koç | Deputy general manager | a.koc | 08:30–19:00; reads board documents |
| Burak Şahin | Dispatch planning | b.sahin | 08:00–18:00 on KL-WS-0518; VPN only on weekend duty |
| Deniz Yılmaz | IT security specialist | d.yilmaz | 08:30–17:30; owns the scanner and the phishing exercises |
| Elif Aydın | Finance specialist | e.aydin | 08:30–17:30 on KL-WS-0377 |
| Emre Yıldız | Legal counsel | e.yildiz | 09:00–18:00 |
| Gizem Tunç | Accounting specialist | g.tunc | 08:30–17:30 on KL-WS-0350 |
| Hakan Er | Gebze warehouse shift supervisor | h.er | 07:00–15:00 on KL-WS-0610 and the camera station KL-WS-0615 |
| Kerem Aksoy | Sales representative | k.aksoy | 09:00–18:00 on KL-WS-0144 |
| Murat Kaya | IT system administrator | m.kaya, adm-m.kaya | 08:00–17:00; annual leave 5–9 November |
| Ozan Çelik | Field sales manager (Aegean) | o.celik | Travels often; reaches the ERP only over the cloud VPN |
| Selin Demir | HR specialist | s.demir | 09:00–18:00 |
| Zeynep Arslan | Purchasing specialist | z.arslan | 08:30–17:30 on KL-WS-0291 |
Account rules
- Personal admin accounts start with adm- and are used only from KL-SRV-MGMT01.
- The only local administrator account is kl-yerelyonetici, whose password is managed by LAPS. There is no other local admin standard.
- svc-yazilimdagitim and svc-yamaci sign in only from KL-SRV-DAG01; svc-yedek only from KL-SRV-BK01. Group policy enforces this.
- The sevkiyat-mobil VPN group has an MFA exception because of old handheld terminals. It is due to be removed in December 2026.
- Users may consent to third-party cloud apps. Restricting consent to verified publishers is an open finding (BG-2026-17).
- Recordings from warehouse cameras are exported only at the legal department's request, onto registered hardware-encrypted USB drives.
FP rate: Share of benign alerts you called malicious.
Alert queue
20 alertsNo alert matches this filter. Change the level or the queue choice.
Pick an alert from the queue. Its clock starts the moment you open it and its status becomes In progress.
Shift report
When every alert of a level is closed, that level's shift report appears here.
Every lab uses invented data and simulates defence work only. Do not test systems you do not own or have written permission to test: unlawful access to an information system is an offence (Turkish Penal Code art. 243).