24observe SOC Labs

Trainers · Reading results

Reading results

While your class works, the Cohort progress table updates live. This page walks every column so you can read the room at a glance — and shows you where the real teaching signal hides.

i

The table is in the instructor view under Training → Labs. It refreshes on its own as students start labs, get seeded with telemetry, and submit dispositions — no need to reload.

The columns, one by one

ColumnWhat it tells you
StudentThe student's account. One row per student per assigned lab.
CohortThe cohort name you chose at provisioning. Use it to filter a single class out of the list.
StatusWhere the student is in the lab lifecycle — assigned, seeded, or graded (see below).
IncidentA link to the incident the detection opened in that student's sandbox. Click through to see exactly what they're looking at.
DispositionThe student's own verdict, marked correct or incorrect against the scenario's ground truth.
AI verdictThe platform AI analyst's independent disposition on the same incident, with its confidence.
ScoreThe auto-grade out of 100: 70 for a matching disposition, 30 for a specific rationale.

Reading the statuses

  • assigned — the lab is provisioned but the student hasn't clicked Start lab yet. A row stuck here is a student who hasn't begun.
  • seeded — telemetry has been generated and the incident has fired. The student is investigating but hasn't submitted a disposition.
  • graded — the student submitted a disposition and received a score. The investigation is complete.

At a glance, a healthy class moves left to right: assigned → seeded → graded. Stragglers in assigned need a nudge to start; a pile-up in seeded often means the investigation step deserves more time or a hint.

The signal that matters most: student vs AI

Read the Disposition and AI verdict columns together — that pairing is the heart of the exercise.

  • They agree, and both are correct. Confirmation. The student reasoned to the same place as the AI analyst. Move on quickly.
  • They disagree. This is your richest material. Either the student out-reasoned a confident AI, or the AI caught something the student missed. Open the incident, find out which, and make it the centerpiece of your debrief.
  • They agree, and both are wrong. Rare, but worth flagging — a shared blind spot is a great class-wide teaching point.

Don't treat the AI verdict as the answer key — the scenario's ground truth is. The AI is a second opinion, and its confidence is part of the lesson: a confident verdict can still be wrong, and students should learn to weigh evidence over assertiveness.

Guessed, or reasoned? Read the score split

A single score hides a lot; the 70/30 split reveals it.

  • Got the disposition, weak rationale (≈70/100). The student likely guessed right — or pattern-matched without showing their work. Correct call, thin reasoning. Coach the rationale.
  • Wrong disposition, strong rationale. The student reasoned carefully but reached the wrong conclusion. Valuable: the thinking is there, so the fix is targeted.
  • Both strong (near 100). Confident analyst. Stretch them with the discussion questions.
  • Both weak. The student needs to walk back through the evidence — point them at the walkthrough.

Suggested follow-up

  • Sort by disagreement (student vs AI) and pull two or three rows for the debrief.
  • Open one correct-disposition, low-rationale incident with the class and ask the student to defend the call out loud.
  • Re-provision and reassign for any student who wants a second attempt — a fresh run is a clean labeled judgement.

Next: the facilitation guide turns these readings into a ready-to-run lesson plan, or revisit Running a cohort to add a latecomer.