Upcoming (V2)Concept preview
starts now.
Triage alerts, investigate cases, build your craft, at your own pace.
Play-Mode Architecture:
Dimension
Facilitator-led (Instructor & Team Cohort)
Self-service (Automated Bot & Coach)
Control Authority
Session facilitator/instructor controls timeline, speed (0.5x–4x), pausing, and vector injection.
Learner controls their own shift pace, pauses locally, and navigates step-by-step at individual speed.
Adversary Behavior
Orchestrated red timeline with Game Master overrides, speed adjustments, and scripted synthetic injects.
Deterministic automated bot: advances on learner detection or escalates when detection timer elapses.
Support Delivery
Live instructor guidance, custom hints on demand, and cohort-wide discussion review.
Deterministic 3-tier hint ladder (concept → approach → syntax) with transparent XP deductions.
Post-Scenario Flow
Facilitated group debrief with scrubbable event markers, cohort leaderboard, and class telemetry comparisons.
Automated end-of-run retrospective report card with pipeline latency, missed techniques, and printable PDF/summary.
Shift 08:00 – 16:00 UTC
Analyst I (Tier 1)
Analyst I (Tier 1)4d streak
320/ 1,000 XP
ACTIVE CASE QUEUE2 Open Tickets
SEC-4029HIGH
Urgent Direct Deposit Re-validation
SLA: 12m remaining08:14:22 UTC
SEC-4030LOW
Scheduled Hypervisor Maintenance Window
SLA: 45m remaining08:26:01 UTC
SEC-4029/
Synthetic enterprise feed (fintechcorp.local)Urgent Direct Deposit Re-validation
EMAIL HEADER INSPECTOR
SPF: FAILDKIM: FAIL
From: FintechCorp Payroll <payroll-service@fintechcorp-secure.invalid>
To: sarah.jenkins@fintechcorp.local
Return-Path:
bounce-tracker@relay-99.mail-relay.invalidSubject: ACTION REQUIRED: Confirm Q3 Direct Deposit Bank Routing Number
Timestamp: Today at 08:12:04 UTC
Dear Sarah,
Our automated payroll synchronization detected an unverified banking profile routing discrepancy for your employee ID #FIN-8821.
Please immediately download the attached reconciliation spreadsheet (Q3_Adjustment_Form.xlsx) and re-verify your direct deposit details within 2 hours to avoid payroll release suspension.
Corporate Finance Operations
FintechCorp Enterprise Services
Q3_Adjustment_Form.xlsx (Macro-enabled Excel)Unsanitized Attachment
SOC DISPATCH CLI ANALYSIS
fintechcorp-soc-cli analyze-msg --msg-id MSG-99124
[1] SPF Check: FAIL - 198.51.100.82 not permitted by sender domain SPF record
[2] DKIM Signature: Header signature corrupted / RSA verification failed
[3] Header Anomaly: Return-Path host relay-99.mail-relay.invalid mismatch with From field
[4] Sandbox Status: Macro payload matches synthetic T1566 lure pattern
3-TIER HINT LADDER
Hints used: 0/3 (penalty capped at 50%)Tier 1: Conceptual Rule
Click reveal to view coaching hint.
Tier 2: Investigation Approach
Click reveal to view coaching hint.
Tier 3: Exact Indicator Targets
Click reveal to view coaching hint.
Indicator Checklist (Tag Anomalies)Select all suspicious indicators
Verify tags before submitting your verdict.
Choose Security Verdict:
SKILL RADARLive Evolution
ADAPTIVE CURRICULUMRule-Based (?)
Recommended Next:Foundational Email & Header Triage (Tier 1)Triggered because lowest skill rating is under 40.
PRACTICE TRACK
Unlock complex multi-stage attack scenarios as your operational craft expands.
Beginner0 – 1,000 XP
Tier 1
Analyst I
Capabilities Unlocked:Triage queue, email header analysis, basic indicator tagging, single-host SDN isolation
Intermediate1,000 – 3,500 XP
Tier 2
Analyst II
Capabilities Unlocked:Multi-stage MITRE kill chain correlation, memory volatility analysis, SMB pivot containment, custom YARA rules
Expert3,500+ XP
Tier 3
Lead Analyst
Capabilities Unlocked:Adversary campaign attribution, live Red vs Blue live-fire scenarios, custom range scenario authoring
Rank names and tier levels are gamification progression markers only, not formal industry credentials or job placement guarantees.
What an individual training session looks like from dispatch to debrief.
STEP 0109:00
Brief
Receive threat intel brief on new synthetic adversary campaigns and active attack vectors.
STEP 0209:30
Investigate
Inspect live telemetry, Sysmon events, and network streams to reconstruct the attack timeline.
STEP 0311:15
Contain
Execute surgical host micro-segmentation and revoke compromised tokens in the range.
STEP 0414:00
Report
Generate concise, structured incident report cards with verified MITRE technique mappings.
STEP 0515:45
Review
Review end-of-shift telemetry graphs, XP gains, MTTD metrics, and skill radar evolution.
Live demo (V1)
Ready to take your first live shift?
Try our solo training flow in the live V1 demo today.