Free lesson 1 of 11 from SOC Analyst & Blue Team — Now catch the attacker — hunt the real logs of the MegaCorp breach with nothing but the shell.. No account, no card.
In the other courses you broke into MegaCorp. Here you sit on the blue team: the attack already happened, it's buried in the logs, and your job is to reconstruct exactly what the intruder did — who, what, when, and did they get in?
No fancy SIEM. Real analysts live in the shell: grep, awk, sort, uniq, cut. Master those on raw logs and you can investigate anything.
Your Live-Lab ships a real incident. Open your box and read the ticket:
cat ~/soc/TICKET.txt ls -la ~/soc/ # auth.log (ssh01) + access.log (web01)
cat ~/soc/TICKET.txt wc -l ~/soc/auth.log ~/soc/access.log
Two logs: auth.log (ssh01 authentication) and access.log (web01 HTTP). Your entire investigation lives in these two files.
⚖️ Defensive analysis on your own lab data. The same skills protect real networks you're responsible for.
11 lessons · knowledge checks · final exam · verifiable certificate · in-browser Live-Lab
Unlock all courses · CHF 9/month Buy only this course · CHF 19