Students · What is a SOC Lab

What is a SOC Lab?

A SOC Lab is a hands-on way to learn security operations by doing the job — investigating real incidents in your own private sandbox, not by reading about them on a slide.

SOC stands for Security Operations Center: the team responsible for watching an organization's systems, spotting attacks, and deciding what to do about them. A SOC analyst is the person at the front line of that work. This platform lets you practice that role end to end, on telemetry that behaves exactly like the real thing.

Why real telemetry beats slides

You can read about a brute-force attack in a textbook and still freeze the first time you see one in a live console. The gap between knowing about an attack and recognising one is the gap this platform closes.

When you start a lab, the platform generates genuine security telemetry in your sandbox — the same kind of activity a production monitoring system would see. A detection rule evaluates it, an incident opens, and you work it the way an analyst on shift would. Nothing is pre-recorded or faked. You build the instinct that only comes from handling the real signal.

What a SOC analyst actually does

Stripped to its core, the job is a loop of four verbs:

• Monitor — keep an eye on the activity flowing through the systems you protect.
• Triage — when an alert fires, judge how urgent and how real it is.
• Investigate — gather the evidence: what happened, from where, how much, how fast.
• Decide — call it. Is this a real threat, harmless noise, or something else? Then justify your call.

Every lab walks you through that exact loop, with feedback at the end so you learn whether your call held up.

The loop, at a high level

1. You start an assigned lab. The platform generates real telemetry in your private sandbox.
2. Within about a minute, a detection rule matches the activity and opens an incident.
3. You investigate the incident and gather your evidence.
4. You submit a disposition — your verdict — plus a written rationale explaining it.
5. You're graded instantly, and the platform's AI analyst shows its own verdict next to yours.

What you'll be able to do

By the time you've worked through the labs, you'll be able to:

• Read an incident and understand what a detection rule is telling you.
• Pull the key facts out of security telemetry quickly and confidently.
• Tell a real attack apart from harmless activity — and explain how you know.
• Write a clear, evidence-bearing rationale that a teammate could trust.
• Map what you see to a recognised attack technique, like T1110 · Brute Force.

Who it's for

No prior SOC experience is needed. If you're a student starting out in security, switching into a defensive role, or just curious about how analysts work, you're in the right place. Each lab is self-contained and guided — you learn the method as you go, not before you start.

Ready to log in and look around? Head to Getting started for your first login and a quick tour. Then learn how a lab is built in Anatomy of a lab, or jump straight into the brute-force walkthrough.