foyl Learn · foyl Mock

Ten tools.
One simulated SOC.

Production-grade blue team consoles with real incident data. No cloud account, no license, no prod to break. Open a console and start working.

10 tools online foyl SecIntel MITRE ATT&CK v14.1 IRON CHIMNEY incident loaded

foyl Mock field guide

A living, connected SOC

These are ten views into the same fictional SecIntel environment, not ten isolated demos. People, hosts, IPs, alerts, cases, and evidence are designed to correlate as you pivot between consoles.

Activity Logs Alerts Cases Response

Two content layers

Both layers use the same environment and schemas, but they serve different learning goals.

CanonHand-authored

Stable, deliberately built incident evidence tied to labs, scenarios, checkpoints, and teaching walkthroughs. Canon IDs and clues stay dependable so guided work has a consistent answer path.

SimgenContinuously simulated

Deterministic activity that keeps the SOC moving. Simgen produces source events and ingested logs, then correlates real alerts, investigations, IOCs, notes, and tasks that age through their lifecycle.

How to use the tools

LabsFollow a guided analyst workflow. The instructions and scored checkpoints usually point you toward stable Canon evidence.
ScenariosTrace one authored incident across multiple consoles and see how identity, endpoint, network, intel, and response evidence fit together.
PracticeOpen any console and hunt freely. Simgen supplies fresh activity for triage, query practice, pivots, and repeated exercises beyond the guided answer path.
TeachingUse Canon for a repeatable class walkthrough, then let learners branch into Simgen content so every investigation is not a memorized screenshot.

Why Simgen exists

A SOC should feel operational, not frozen. Simgen adds meaningful background activity and evolving detections while preserving the authored incidents that labs and scenarios depend on. It keeps queues fresh, makes open-ended hunts useful, and gives repeated practice a believable evidence trail.

Need to separate the layers? The SIEM Alerts and Investigations pages include Content filters for All, Simgen, and Canon. Generated investigations begin active, progress through review and closure, and leave the board after their retention window.

Start a lab Browse scenarios Learn quick guide

Detection & Response

SIEM Live

Security Information & Event Management

Correlate security events across your entire environment. Hunt threats with Foyl query rules, build timelines, and drive investigations from alert to resolution.

Alerting Investigations Log Search Reports

Open tool →

EDR Live

Endpoint Detection & Response

Monitor endpoints for malicious activity, isolate compromised hosts, and dig into process trees and memory artifacts across your endpoint fleet.

Detections Process Tree Isolation Hunt

Open tool →