quiet signal

./soc-lab --simulated

SOC lab

An alert queue from a made-up company. Open an alert, read the raw event, decide what it is, then compare your call with the analyst notes. Several alerts are connected; finding the links is part of the exercise.

Simulated environment All alerts, hosts, accounts and addresses are synthetic. IP addresses use ranges reserved for documentation, and domains use example names. Nothing here comes from a real network.

18 alerts

Severity Time (UTC) Alert Host Status
Critical 2026-10-20 14:03 SRV-FILE-01 Investigating
Critical 2026-10-20 13:42 WS-ACCT-07 New
High 2026-10-20 13:45 WS-ACCT-07 New
High 2026-10-20 12:51 n/a (cloud sign-in) New
High 2026-10-20 11:05 WS-IT-03 Investigating
High 2026-10-20 04:01 DC-01 New
High 2026-10-20 03:17 SRV-FILE-01 New
Medium 2026-10-20 10:26 WS-SALES-12 Investigating
Medium 2026-10-20 09:58 WS-SALES-12 New
Medium 2026-10-20 08:12 SRV-WEB-01 New
Medium 2026-10-20 07:44 WS-ENG-05 New
Low 2026-10-19 22:40 n/a (cloud sign-in) Closed
Low 2026-10-19 19:10 WS-MKT-09 Closed
Low 2026-10-19 12:30 DC-01 Closed
Low 2026-10-19 02:00 SRV-WEB-01 Closed
Informational 2026-10-19 16:02 WS-HR-02 Closed
Informational 2026-10-19 15:21 DC-01 Closed
Informational 2026-10-19 14:15 WS-IT-03 New
How the triage works
Alert triage flow An alert is checked for plausibility, mapped to a MITRE ATT&CK technique, and given a disposition. False positives and benign activity are closed and the rule tuned. True positives are contained and escalated. Alert fires rule + raw event Plausible? normal for host/user Map technique MITRE ATT&CK Disposition decide and record why Close and tune false positive, benign Contain, escalate true positive
Every alert in the demo is worked through these steps. The triage panel shows the reasoning at each one.

The data, filtering logic and tests are described on the project page. A full walkthrough of one alert is in the write-up Brute force followed by a successful logon.