Season 0 is completely free
Episode 3 of 5
Follow the Thread
Tuesday, 2:45 PM. The watch on j.doe's account just reported a VPN session. Find out who it was, what they did, and where they came from.
40-50 min
Beginner
Browser-based — no VMs
Log/SIEM Analysis
Threat Intelligence
What you'll practice
This episode focuses on the investigation skills below. Sign up to work the live case — no spoilers, answers, or IOCs are shown here.
Log/SIEM Analysis
Correlate SIEM events into a timeline and follow the attack across systems.
Threat Intelligence
Cross-check IOCs and campaign context to decide what is noise and what is real.
Analyze phishing emails and extract IOCs
Correlate SIEM logs to build attack timelines
Season Zero progression
Follow one incident from first alert to containment across five episodes.