Step into a Security Operations Center. Analyze AI-generated alerts, investigate network traffic, and determine which threats are real.
This training is modeled on real-world cybersecurity operations — the decisions, tools, and tradeoffs that SOC analysts face every day.
You are a cybersecurity triage analyst — the first line of defense when alerts arrive. You decide what is real and what is noise.
Based on real SOC operations. The tools are authentic, the data is realistic, and the decisions reflect genuine analyst tradeoffs.
Determine which attacks are real, reconstruct attacker activity, and produce a clear report understandable by non-technical stakeholders.
Real SOC analysts follow a structured sequence. Understanding this workflow before you touch any data is what separates disciplined analysis from guesswork.
The intrusion detection system flags a suspicious network connection and surfaces a summary: source IP, destination IP, ports, timing, and the predicted attack category. This is your starting point — nothing more.
Because alerts arrive continuously and analyst time is finite, you must decide which alerts deserve immediate investigation. This is one of the most consequential decisions in the entire process.
Formally take ownership of the selected alert. In production SOC environments, this prevents two analysts from investigating the same incident simultaneously and wasting resources.
Open the packet capture file and look for concrete packet-level evidence. Filter by IP, port, protocol, and time window. Look for the specific behavioral patterns the LIME explanation pointed you toward.
Based on the PCAP evidence — or lack of it — classify the alert: true positive (confirmed attack) or false positive (benign traffic misclassified by the AI). Document your reasoning either way.
Alerts come from Intrusion Detection Systems (IDS). There are two fundamentally different approaches — understanding the difference matters for how you evaluate alerts.
Rule-driven detection
Anomaly detection
Every alert includes a visual explanation generated by LIME (Local Interpretable Model-agnostic Explanations). You don't need to know the math — here's how to read it.
Each attack type leaves a distinctive fingerprint in the packet data. Know the pattern before you open the capture file.
A reconnaissance technique where an attacker systematically probes a target machine by sending connection requests to many different port numbers. The goal is to discover which ports are open and which services are running, in order to identify potential entry points before launching a more targeted attack.
An automated attack where the attacker repeatedly attempts to authenticate to a service — such as SSH, FTP, or a web login — by trying many different username and password combinations in quick succession, hoping to eventually guess valid credentials.
A volumetric denial-of-service attack where the target web server is overwhelmed with a massive flood of HTTP requests, far exceeding what any legitimate user traffic could produce. The aim is to exhaust server resources — CPU, memory, or bandwidth — so that the service becomes unavailable to real users.
You cannot investigate 15 alerts with equal depth. Time is always limited. Here is how to decide what to investigate first.
After the PCAP investigation, you reach a binary decision. Both outcomes are valid — identifying false positives is as important as confirming real attacks.
Everything you need to carry into the investigation.
Read each alert and its LIME explanation. Form an initial impression of what is being flagged and how confident the model is. Do not investigate yet — observe first.
Rank alerts by attack type, confidence score, and source IP patterns. Select which to investigate first, just like a real SOC analyst working under shift time pressure.
Take ownership of selected alerts and investigate the PCAP data in Wireshark. Apply the attack pattern knowledge from this training to locate specific packet-level evidence.
Classify each investigated alert as a true positive or false positive. Compile your findings into a structured investigation report written clearly enough for non-technical stakeholders.