Training Labs

Practise with the real tools against invented incidents — zero setup, no account, nothing leaves your browser.

5 labs across four spice levels. A tier is a label, not a gate: start anywhere.

Loading progress…

Mild Bowl

Read carefully, use one tool, find the thing.

Which line is safe to paste?

You are about to paste a malicious URL into a ticket that colleagues, a chat bot and a link-preview service will all read. Four ways of writing it are below. Which one is correctly defanged?

Tool: IOC DefangerStart →
Find the three outside IPs

A junior analyst flagged this proxy log excerpt as suspicious. The corporate network is 10.0.0.0/8; everything else is outside. Find the three IP addresses that do not belong to the corporate range.

Tool: IOC DefangerStart →

Medium Bowl

Interpret evidence and name what you see.

Name the technique

EDR shows this process tree on a finance workstation. Which ATT&CK sub-technique ID describes the highlighted step?

Tool: MITRE ATT&CK SearchStart →

Spicy Bowl

Several conversions or sources; one wrong step and the answer is off.

When did it really start?

Three systems logged the first signs of the same intrusion — each in its own format and unit. Which event happened first? Give its time in UTC as ISO 8601

Tool: Timestamp ConverterStart →

Extra Spicy

Reconstruct a whole chain the way an analyst would.

Map the whole chain

A ransomware crew's actions on one host, reconstructed from EDR and Windows logs. Map every step to its ATT&CK technique and submit the five parent technique IDs

Tool: MITRE ATT&CK SearchStart →

Informational only — a practice sandbox, not an assessment or a certification. Each lab names the exam areas it touches (Security+, CySA+, GCIH…) as a loose pointer; see the Certifications Hub for the study side. Want to know what a term means first? The Glossary explains each concept with a worked example.