Season 0 is completely free
Episode 5 of 5
Containment
Thursday, 7:30 AM. IT worked the ticket overnight. Before anything comes back online, check their work: the scope, the machine, and the campaign.
40-50 min
Beginner
Browser-based — no VMs
Log/SIEM Analysis
Endpoint Investigation
Threat Intelligence
What you'll practice
This episode focuses on the investigation skills below. Sign up to work the live case — no spoilers, answers, or IOCs are shown here.
Log/SIEM Analysis
Correlate SIEM events into a timeline and follow the attack across systems.
Endpoint Investigation
Review process activity and persistence clues on compromised hosts.
Threat Intelligence
Cross-check IOCs and campaign context to decide what is noise and what is real.
Analyze phishing emails and extract IOCs
Correlate SIEM logs to build attack timelines
Investigate endpoints for persistence mechanisms
Season Zero progression
Follow one incident from first alert to containment across five episodes.