Security operations overview
Investigate sample incidents, make verdicts and practise analyst decisions.
Simulated Corporate SOC
You are the on-duty analyst at a fictional Indian company. Work the queue, document evidence, and escalate incidents using the L1 → L2 → L3 workflow.
Corporate roleplayEscalation practiceIndian scam scenarios
Analyst mission
Work the alert queue like a Tier 1 SOC analyst. Review evidence, identify suspicious activity, choose a verdict and write a short closure note.
Email securityIdentityEndpointNetwork
Training rules
All names, IPs, domains and events in this lab are fictional examples. No real tenant or production telemetry is connected.
Recommended first task
PH-1001 · Suspicious invoice email — inspect sender, URL and user interaction, then classify the alert.
Alert queue
Select an alert to open its investigation workspace.
| Alert ID | Alert name | Category | Severity | User / host | Status |
|---|
Investigation
Alert evidence
Analyst task
Investigation checklist
Use this sequence for each alert:
① Validate alert context
② Review user, device and time
③ Inspect indicators and evidence
④ Decide true or false positive
⑤ Document and close
Do not decide from severity alone. Base your verdict on the evidence in the alert.
KQL practice
Run beginner queries against a small fictional sign-in dataset.
TRY THIS QUERY
What to learn
whereprojectsummarizecountorder by
KQL is the query language used by Microsoft Sentinel and other Microsoft security data experiences.
Learning path
Progress from alert triage to threat hunting.
Choose a module to begin
Study the lesson, complete the practical exercise and pass the quiz.
Simulated Corporate SOC
Your shift has started. You are the L1 analyst for fictional company BluePeak India.
Today's shift briefing
08:55 IST — The service desk reports unusual employee sign-in activity and a finance employee has reported a suspicious payment message. Review the alerts, preserve evidence, and choose whether to close or escalate.
Expected workflow: Validate → Scope → Investigate → Contain recommendation → Document → Escalate if needed.
Escalation ladder
L1: Alert triage, evidence collection and initial verdict.
L2: Correlate events, determine scope and recommend containment.
L3: Lead complex investigations, identify root cause and recommend detection improvements.
Tier is a training progression based on points, not a real job certification.
Indian Scam Investigation Labs
Practice identifying common UPI, bank impersonation and payment fraud patterns. All scenarios are fictional.
QR code collect-request scam
A fictional employee receives a message claiming a refund is pending and is asked to approve a UPI collect request. Investigate the social-engineering indicators.
Fake SBI KYC update
A message impersonating a bank warns that the account will be blocked unless KYC is updated through a suspicious link.
Fake payment screenshot
A seller receives a screenshot claiming payment was completed, but the account has no matching credit. Review the evidence and response steps.
Training only: never enter real banking credentials, UPI PINs, OTPs or card details in a lab.
AI SOC Manager
Ask for investigation guidance, evidence checklists and escalation advice.
SIMULATED OFFLINE MENTOR · NOT CONNECTED TO A LIVE AI SERVICE
Mentor guidance is prewritten for this prototype. A real-time AI assistant requires a secure backend/API integration later.
Career progression & resume
Build a training portfolio from your completed investigations.
Your analyst progression
Build your foundation by completing alert triage labs.
L1: 0–49 points · L2: 50–149 points · L3: 150+ points
Generate your resume draft
Resume preview
Complete practical labs to build your training portfolio. Your resume draft will appear here.
This is a training portfolio draft, not proof of employment, professional experience or an accredited certification. Review and edit it honestly before applying for jobs.
Progress & score
Your results are saved in this browser on this device.
Reset training progress
This clears your completed-alert scores from this browser only.