foyl Learn · foyl Mock

Ten tools.
One simulated SOC.

Production-grade blue team consoles with real incident data. No cloud account, no license, no prod to break. Open a console and start working.

10 tools online foyl SecIntel MITRE ATT&CK v14.1 IRON CHIMNEY incident loaded

foyl Mock field guide

A living, connected SOC

These are ten views into the same fictional SecIntel environment, not ten isolated demos. People, hosts, IPs, alerts, cases, and evidence are designed to correlate as you pivot between consoles.

Activity Logs Alerts Cases Response

Two content layers

Both layers use the same environment and schemas, but they serve different learning goals.

CanonHand-authored

Stable, deliberately built incident evidence tied to labs, scenarios, checkpoints, and teaching walkthroughs. Canon IDs and clues stay dependable so guided work has a consistent answer path.

SimgenContinuously simulated

Deterministic activity that keeps the SOC moving. Simgen produces source events and ingested logs, then correlates real alerts, investigations, IOCs, notes, and tasks that age through their lifecycle.

How to use the tools

LabsFollow a guided analyst workflow. The instructions and scored checkpoints usually point you toward stable Canon evidence.
ScenariosTrace one authored incident across multiple consoles and see how identity, endpoint, network, intel, and response evidence fit together.
PracticeOpen any console and hunt freely. Simgen supplies fresh activity for triage, query practice, pivots, and repeated exercises beyond the guided answer path.
TeachingUse Canon for a repeatable class walkthrough, then let learners branch into Simgen content so every investigation is not a memorized screenshot.

Why Simgen exists

A SOC should feel operational, not frozen. Simgen adds meaningful background activity and evolving detections while preserving the authored incidents that labs and scenarios depend on. It keeps queues fresh, makes open-ended hunts useful, and gives repeated practice a believable evidence trail.

Need to separate the layers? The SIEM Alerts and Investigations pages include Content filters for All, Simgen, and Canon. Generated investigations begin active, progress through review and closure, and leave the board after their retention window.

Start a lab Browse scenarios Learn quick guide

Detection & Response

Security Information & Event Management

Correlate security events across your entire environment. Hunt threats with KQL-style queries, build timelines, and drive investigations from alert to resolution.

Alerting Investigations Log Search Reports

Endpoint Detection & Response

Monitor endpoints for malicious activity, isolate compromised hosts, and dig into process trees and memory artifacts across your endpoint fleet.

Detections Process Tree Isolation Hunt

Security Orchestration, Automation & Response

Run automated playbooks, manage response cases, and coordinate cross-tool actions without leaving a single pane of glass.

Playbooks Cases Automation

Network & Perimeter

Next-Generation Firewall

Inspect network traffic at the application layer, manage policy rules, detect lateral movement, and respond to perimeter threats in real time.

Traffic Logs Policy Rules Geo Block

Cloud Access Security Broker

Discover shadow IT, enforce cloud app policies, investigate DLP incidents, and govern data movement across sanctioned and unsanctioned cloud services.

Shadow IT DLP App Control Policies

Identity & Email

Identity & Access Management

Manage users, roles, and permissions. Investigate risky sign-ins, review MFA gaps, audit PIM elevations, and respond to account compromise.

Users Risky Sign-ins MFA PIM

Triage phishing reports, analyze email headers and message traces, quarantine malicious messages, and track BEC campaigns to their source.

Quarantine Headers BEC Phishing

Intelligence & Risk

Threat Intelligence Platform

Search and pivot across IOCs, track threat actors and campaigns, manage intel feeds, and produce finished intelligence reports for your stakeholders.

IOCs Actors Campaigns Feeds

Vulnerability Management

Review scan findings, prioritize by CVSS and real-world exploitability, track remediation SLAs, and generate executive risk reports.

CVSS Findings Remediation SLA

Jira-style ticket management built for security teams. Track incidents, manage sprints, monitor SLA compliance, and visualize workload with a kanban board.

Kanban Sprints SLA Burndown