Season 0 is completely free
Episode 4 of 5
Lateral
Wednesday, 9:00 AM. A Finance colleague forwards a note that looks like it came from j.doe and asks if it is real. Every check passes. Follow it from an inbox to a machine.
40-50 min
Beginner
Browser-based — no VMs
Email Analysis
Log/SIEM Analysis
Endpoint Investigation
What you'll practice
This episode focuses on the investigation skills below. Sign up to work the live case — no spoilers, answers, or IOCs are shown here.
Email Analysis
Inspect phishing emails, headers, and indicators the way a SOC email specialist would.
Log/SIEM Analysis
Correlate SIEM events into a timeline and follow the attack across systems.
Endpoint Investigation
Review process activity and persistence clues on compromised hosts.
Analyze phishing emails and extract IOCs
Correlate SIEM logs to build attack timelines
Investigate endpoints for persistence mechanisms
Season Zero progression
Follow one incident from first alert to containment across five episodes.