Hands-on cybersecurity investigation scenarios covering email analysis, SIEM correlation, endpoint forensics, and threat intelligence. Browse case briefs publicly, then sign in to open the interactive workbench.
Wealth advisor a.chen flagged a 2026 benefits enrollment email whose portal link does not match Straylight HR systems. Auth failures and a lookalike enrollment domain are already on the table. Prove or kill the phish call.
Brand monitoring just lit up straylight-payments.com, a fresh registration riding Straylight's treasury brand. Eli needs you to validate reputation, registration, and related infra before Finance starts wiring money to the wrong place.
ED-102 pinned straylight-payments.com to 198.51.100.55 on Sundial Hosting. Eli wants the shared-hosting neighborhood mapped before treasury burns the whole netblock.
Identity protection saw a burst of VPN failures from 203.0.113.44 across treasury mailboxes, then a successful logon for a.chen. Mara needs the spray-to-success chain proved in the SIEM before anyone resets half of Finance.
Minutes after a.chen reported a wire-instruction email, EDR caught WINWORD spawning mshta on ws-fin-01. Mara needs the process chain and remote script host before Finance keeps working on a live host.