Train on real tools.
No setup required.

TCP/IP, DNS resolution, firewall ACLs, and SIEM network visibility — built around real analyst tooling.

AiTM phishing → credential theft → lateral movement → exfiltration. First alert through incident report.

ATT&CK framework, threat actor profiling, malware lifecycle, detection rule writing, and kill chain disruption.

Query live Ficsit Inc. logs, triage an alert queue, and build a detection rule — all inside an embedded Foyl SIEM.

CVSS scoring, KEV cross-referencing, asset criticality tiers, patch workflow, and SLA tracking across a realistic asset inventory.