SOC Analyst Platform | Comprehensive Lab

Security Operations Center Training Environment

🛡Comprehensive data analysis | real scenarios | interactive learning

2026-05-30 04:14
SOC 🔗 SOC Simulator
📈 Total Events
--
⚠️ Critical (sev5)
--
🚫 Block Rate
--%
Severity Distribution
Top Alert Types
Daily Event Trend (14 days)
Actions (Block/Allow)
💡 Smart Insights
Loading insights...
🔎 Filter Logs
TimestampSource IPDest IPProtoActionSevAlert TypeDetails
Loading logs...
📓 Security Analysis Notebook (run cells to execute queries)
In [1]:
# Count total events
SELECT COUNT(*) FROM logs;
(not run)
In [2]:
# High + Critical severity
SELECT COUNT(*) FROM logs WHERE severity >= 4;
(not run)
In [3]:
# Top 3 alert types
SELECT alert_type, COUNT(*) FROM logs GROUP BY alert_type ORDER BY COUNT(*) DESC LIMIT 3;
(not run)
In [4]:
# Noisiest source IP
SELECT source_ip, COUNT(*) FROM logs GROUP BY source_ip ORDER BY COUNT(*) DESC LIMIT 1;
(not run)
In [5]:
# Block percentage
SELECT ROUND(SUM(CASE WHEN action='BLOCK' THEN 1 ELSE 0 END)*100.0/COUNT(*),1) FROM logs;
(not run)
$ SOC Analyst Terminal
> SOC terminal ready. Type 'help' for commands.
💡 Example: show alerts severity=5 , stats , top sources
💀 Ransomware Campaign
Simulated attack: encryption of file shares, lateral movement.
Critical
🎣 Phishing Attack
User clicked malicious link → credential harvest → data exfiltration.
High
🕸️ Lateral Movement
PsExec, WMI, SMB attacks moving east-west.
High
📜 Scenario Details & Investigation Guide
Click a scenario card to see detailed analysis and guided exercises.