Thirty minutes inside a living SOC. Three curated desks - Foundation, Intermediate and Capstone - each a hand-built incident. Work the queue as it arrives, pull context from the same consoles you train on, contact the people involved, make the call, and leave the next analyst a handoff they can trust.
Choose a shiftThree curated desks · Foundation, Intermediate, Capstone · 30 minutes each
Loading the shift board…
How a shift runs
01
Work the queue
Signals arrive while the clock runs. You decide what deserves attention first - a loud alert is not always the important one.
02
Use the floor
Open the same SIEM, EDR, mail, identity, and network consoles used across foyl Learn to gather evidence and confirm context.
03
Own the call
Contact users, record what you validated, disposition each alert, and explain your judgment in the handoff.
0alerts queued
30minutes
Normalenvironment
Expected signal pressurevolume only - severities stay unknown until they arrive
start+10 min+20 minhand off
⏴ Previous analyst handoff
◉ Business context
⚙ Maintenance windows
◎ Shift objectives
Desk parameters the queue is rebuilt deterministically from a seed - no two runs repeat
Difficulty
Noise
Speed
Support level the incident is identical - only the coaching changes
The clock starts when you begin. Work the queue, open the real consoles for evidence, and hand off before time runs out.
You are the analyst on shift. Alerts arrive on a clock. Your job is to work each one to a confident call and leave a handoff the next analyst can trust. Here is the loop you will repeat for every case.
1
Watch the queue
Signals land in the Case queue on the left while the clock runs. Related alerts group into one case. A loud alert is not always the important one - triage on context, not colour.
2
Open a case
Click a case to open its full console. The workspace keeps Evidence, Notes, Activity and People in four tabs. Find observables underneath the evidence.
3
Pull the evidence
Each alert's telemetry lives in the real console - SIEM, EDR, identity, mail. Open the linked record, then attach the leads that hold up. Read each lead before deciding whether it belongs on the case file.
4
Make the call
Open Decide & respond for the active alert: set a working hypothesis, choose its disposition, contact the user if a statement would settle it, and take the response that fits the evidence. Disruptive actions against legitimate activity are scored mistakes.
5
Hand off before time runs out
Open the Handoff tab and write what you validated, what is still open, and what the next analyst should do first. Then Hand off & end to close the shift and see your debrief.
What a strong shift looks like
Every alert ends with a disposition - benign, suspicious-but-legit, or malicious.
Evidence is pulled from the consoles, never guessed.
Every disruptive response is justified, never reflexive.
Your handoff explains the calls you made and why.
Reopen this anytime with the Shift options menu.
Unsaved work from this tab
The run ended before this draft was accepted. It is not part of the scored report. Copy it before leaving.