Season 0 is completely free
Episode 4 of 5
Lateral
Wednesday, 9:00 AM. They're already inside. Stolen credentials are being used across the network. Find out where and how far they went.
40-50 min
Beginner
Browser-based — no VMs
Email Analysis
Log/SIEM Analysis
Endpoint Investigation
What you'll practice
This episode focuses on the investigation skills below. Sign up to work the live case — no spoilers, answers, or IOCs are shown here.
Email Analysis
Inspect phishing emails, headers, and indicators the way a SOC email specialist would.
Log/SIEM Analysis
Correlate SIEM events into a timeline and follow the attack across systems.
Endpoint Investigation
Review process activity and persistence clues on compromised hosts.
Analyze phishing emails and extract IOCs
Correlate SIEM logs to build attack timelines
Investigate endpoints for persistence mechanisms
Season Zero progression
Follow one incident from first alert to containment across five episodes.