Glossary

Plain-language definitions of the terms and metrics used across the platform.

Assigned work and what its statuses mean: Assigning asks a person, a team or the whole organisation to complete a lab or a path. Assigning to a TEAM means whoever is in that team when the list is read, so somebody who joins next week owes it too, and a sub-team owes what its parent was given.; A due date is optional, and work with no date is never late.; The statuses are NOT STARTED, IN PROGRESS, COMPLETE, DUE SOON and OVERDUE. Complete beats every date: somebody who finished last month is not overdue.; DUE SOON means the date is near and the work is not finished. It is a fact about the date, not a judgement about the person: this platform records when a run started and when it ended, and nothing about the effort in between, so it cannot tell whether anybody is behind and does not pretend to.; Withdrawing an assignment removes the obligation and nothing else. Work already completed stays exactly where it is.
Audit trail: A record of who did what and when in your team: role changes, deactivations, invitations, and members joining.; It is an accountability log, kept append-only. It is not the tamper-evident forensic evidence ledger, and it is not cryptographically tamper-proof.
Azure portal: Cloud labs are worked in the Azure portal. You sign in with your own lab account, a Microsoft Entra account created for you the first time you ask, which carries neither your name nor your email address. The same account signs you in to the AWS and Google Cloud labs on your plan.; For each run it can read that lab's resources and change nothing, and that access ends with the run. The first time, you sign in with a pass issued for the run and Microsoft asks you to register security information; you then set your own password with Forgot my password, and sign in with it and your authenticator from then on.
Chain of custody: An append-only, hash-chained record of who touched each piece of evidence and when.; It is tamper-evident, so any change is detectable. It is training documentation, not court-admissible evidence.
Challenge mode: Challenge mode hides the severity each log source assigned to an event. Training shows it.; That one column is the difference between triage and filtering. Sources rate events from what they can see at the time, so a scanner sweeping your estate is rated high and a consent grant that hands away a mailbox is rated informational. A responder who learns to sort by severity has learned to miss the second one.; Training keeps severity visible on purpose: you cannot learn when a source is wrong without seeing what it claimed.
Challenges: A set of challenges. Some labs hand over their evidence to download; others are worked in a cloud console from a link.; You submit a flag, or a written report, for each. Flag challenges are scored automatically; a report is written here and read by an instructor, who records a verdict you see on your run. Reports earn no points.
Cloud DFIR: Digital forensics and incident response in the cloud: investigating what happened across cloud logs, identities, and workloads.
Cloud range: A real cloud environment, built fresh for your run and worked in a terminal on its jump host, which is the only way in.; You are graded on the state you leave the environment in - the objectives you achieve - not on the commands you type.; It is worked in a terminal in the browser. Where that is not offered, the lab cannot be started.
Cloud range: A real cloud environment, built fresh for your run and worked in the Azure portal with your own lab account: a Log Analytics workspace with Microsoft Sentinel over it, loaded with the lab's data when the run starts, usually within fifteen minutes.; You open it from the run page, query it in Logs and work its incidents in Microsoft Sentinel, and answer the lab's questions here. The workspace is yours for the run and is destroyed with it. There is no terminal: nothing in it is reached over a shell.
Cohort analytics: How your whole team is doing: completion rates, the spread of grades, and which objectives and challenge categories people find hardest.; The cohort figures here are anonymous aggregate: they carry no identifier and there is no per-trainee breakdown on this page. A member's own runs and accuracy are on their progress page, which they and their administrators can both open. The medians here are directional indicators of where to focus teaching, not precise measurements.
Collection: Labs come in collections: CloudLabs, Training, and the Academy's own labs. Your organisation's plan decides which collections you can start. The Academy's own labs are open on every plan, apart from the two that build a cloud environment for each run, which come with every paid plan.
Detection: The share of the incident's true signals you correctly flagged. Higher means you missed less of what mattered.
Difficulty: How challenging the lab is: basic, intermediate, or advanced. Start lower and work up as your times improve.
Evidence integrity: Each item is fingerprinted with a SHA-256 hash when it is captured and stored read-only, so you can verify it has not changed since collection.
Exporting a case: Downloads the case as a single file: its details, every artefact's SHA-256 fingerprint, and the full custody ledger including its seal.; Anyone you hand it to can re-verify it offline with the ledger's public key, without access to the platform. It carries the fingerprints and the custody record, not the evidence files themselves, and no personal data.
Grade: An A to F grade summarising how you did against the lab's objectives.; It combines how much of the incident you detected with how well you responded.
Guided and assessed labs: Both are real training. The difference is whether this lab's evidence can measure anybody.; An assessed lab has activity that matters and looks routine, and activity that looks alarming and does not, so it cannot be worked by sorting the severity column. That is the judgement a responder is actually paid for: in a real estate the loudest thing in the console is nearly always the backup job.; A guided lab's severities line up with the incident. It teaches the shape of an attack well, and it is not a test: a trainee could reach the right answer without reading a single log line. Nothing is wrong with it, and it should not be set as an assessment.; This is derived from the content itself whenever a lab is imported or seeded, not ticked by an author.
How a flag is matched: A submission is accepted if it matches the flag or any accepted answer you add. By default the match is case-sensitive; tick 'match regardless of letter case' for a case-insensitive challenge. Only surrounding whitespace is ever ignored.; Under 'Also accept' you can add more exact answers, or a format regex. Exact answers are hashed like the flag and never stored in the clear. A regex is matched against the submission, so it is stored in the clear: it is signed (tamper-evident) but readable, so keep it format-only, for example ^INV\{[0-9a-f]{16}\}$, and use hashed exact answers when the answer itself must stay secret.; The flag and exact answers are stored only as hashes and never shown again. Leave the flag blank on an existing challenge to keep the stored one; leave 'Also accept' untouched to keep its saved answers.
Investigation: A captured, anonymised incident that replays identically for everyone.; You investigate the evidence and record what you find; your detection and response times are measured.
Invitations: Invite a teammate by email before they have ever signed in.; No account is created until they first sign in with a verified email. Until then you can revoke the invitation at any time.
Lab account: Your own Microsoft Entra account for the cloud labs, created the first time you ask, from a run or from your lab account page under Settings. It carries a made-up name, never your name or email address, and signs you in to the cloud consoles your lab account page lists, for the labs and training your organisation's plan includes.; Your first sign-in uses a pass shown once. You then register the Microsoft Authenticator app and set your own password with Forgot my password. Where the page lists AWS or Google Cloud and the Academy can check, it says beside each whether your account is set up there: usually within a minute of it being created, and at most an hour.
Lab shell: A real, isolated container you work in a terminal in your browser.; You are graded on the state you leave the system in - the objectives you achieve - not on the commands you type.; It is worked in a terminal in the browser. Where that is not offered, the lab cannot be started.
Ledger seal: The custody ledger is a hash chain: each entry locks in the one before it, so altering any past entry is detectable. That tamper-evidence holds whether or not the ledger is signed.; When a signing key is configured, the platform also signs the chain's head with a key kept off the database, so a change made directly in the database is detectable too. External time-anchoring (a trusted timestamp) is a separate control and is not enabled here.; This is designed for training and internal review. It is not court-admissible evidence.
Mean time to detect: How long it took to spot the incident, from when it began to your first correct detection.; Lower is better: it reflects how quickly a real attack would be caught.
Mean time to respond: How long it took to contain the incident after detecting it.; Lower is better: it reflects how quickly the damage would be stopped.
Programme KPI: The cohort's median detection and response times, tracked across the whole programme. The target is a 25% or better improvement over the starting baseline.; This is a measured operational indicator of progress, not a statistically powered scientific result.
Reading the catalogue: Each row is one incident. The badge beside its title tells you what you will actually do: read captured telemetry, work a real machine in a terminal where that is offered, work a cloud environment in the Azure portal, or answer challenges, over evidence you download or in a cloud console.; Track is the discipline and difficulty is the challenge level. Only published labs can be started, which is what the status column tells you. A badge naming a publisher means the content was signed by one the platform trusts; most content is unsigned, so no badge is normal. Settings can narrow the list to your preferred difficulty.; Some labs belong to a collection your organisation's plan may not include; those say which plan includes them. A lab whose way in is still being set up says it is not available yet.
Recording a verdict: Accept marks the deliverable as meeting the bar. Return for revision sends it back with a note saying what to change, and requires that note so the feedback is actionable.; Either way the trainee sees your verdict on their run. Reports are not scored: a verdict is qualitative feedback and changes no points.; If the trainee resubmits while you are reading, the platform refuses the stale verdict and asks you to reload, so you never record a judgement on work you did not see.
Response: The share of the correct containment actions you took. Higher means you responded more completely.
Roles: There are three. A trainee runs labs, and sees their own runs, cases and results, plus a progress page showing what they have completed and how accurate they have been.; A manager runs training for the organisation. They schedule and facilitate exercises, read what training has happened including the cohort analytics, mark written work, and open any member's training record. They author no labs, invite nobody, and change nobody's role, which is what keeps a manager short of an admin.; An org admin can do everything a manager can, and additionally author and publish labs, invite and deactivate people, change what everybody may do, share an exercise with another organisation, and read the audit trail.; A manager covers the whole organisation rather than a subset of it, because there is no unit smaller than an organisation for a role to be confined to. Anyone signed in sees only the sections their role opens: a page you cannot use is not shown rather than shown and then refused.; Opening somebody's progress page shows the same page that member sees, and their own copy says plainly that their administrators and managers can read it.
Roles and access: The app owns roles and access; the sign-in provider only proves who someone is.; Changing a role or deactivating someone takes effect on their next request.
Shared cloud range: A real cloud environment, built once and read by everybody taking this lab. You open it in the Azure portal with your own lab account, which can read the lab's data and change nothing.; Everyone answers the same questions over the same data, so this lab is for practice rather than assessment, and your work on it is not reported as a measurement of you.
Signed by a trusted publisher: This lab was published from a content bundle that a trusted publisher signed, and the platform verified that signature when the content was imported.; The signature proves the content is authentic and unchanged since that publisher signed it. It does not certify the content is safe: every lab runs in an isolated sandbox regardless of who signed it.
Single sign-on: Your organisation can sign its people in through its own identity provider, over SAML 2.0 or OpenID Connect. You set it up here, and we configure it; nobody at our end has to act.; If you use Microsoft 365, this is one approval and nothing else. Press Connect Microsoft Entra ID, and one of your Microsoft administrators approves us once in your own admin centre. You register no application, copy no client id and hold no secret. We ask only to sign your people in, so there is no permission on your directory to grant.; For any other provider, tell us the protocol, the name your staff will recognise, the address of your provider, and the application id and secret your provider issued for us. We write the connection from that. The secret is used once and kept by our identity server; we do not store it, which is why the field is blank afterwards and filling it in is how you replace it.; Check it first. The check fetches the document at the address you gave and tells you what is wrong with it: an address we cannot reach, the wrong kind of document, or one that names a different issuer to the address it sits at. That last one is the common mistake and it fails much later, when a token is validated, with an error that looks nothing like its cause.; A passed check means your details are consistent with each other. It is not a promise that sign-in works. Sign-in is working when somebody actually signs in, and the page says so when they do; if we could not configure what you gave us, it says that instead, and why.; Claim your domains on the same page. Each gets a DNS TXT record to publish, and we look for exactly that value at exactly that domain: claiming proves nothing, publishing does.; You can retire password sign-in for your staff once people are actually arriving through your provider. It stays available to the admins who hold the way back in.; Keep at least one admin who signs in with a password. Once your people are arriving through your provider, we refuse to demote or deactivate the last one, because an outage at your provider would otherwise lock your organisation out of its own account.
SOC detection: Security-operations detection engineering: writing and tuning the detections that catch attacks in cloud telemetry.
Status: Draft labs are still being authored; validated ones have passed review; only published labs can be started.
Teams and sub-teams: A TEAM is a standing group inside your organisation. It is not the same thing as the room on a facilitated exercise, which lasts as long as that exercise and no longer.; A team may have SUB-TEAMS, one level deep. Whoever runs a team sees its sub-teams too, so giving somebody a parent gives them everything under it. A sub-team cannot have sub-teams of its own.; Somebody may sit in more than one team, and membership is read when a list is drawn rather than stored on the work: assign something to a team and whoever joins next week owes it too.; A team nobody runs is a normal state. It exists and can be assigned work; no manager sees it until you give it an owner.; Removing a team removes it, its sub-teams and its membership. Nothing anybody has completed is touched: finishing a lab is a fact about the person, not a property of the group they were in.
Techniques exercised: The MITRE ATT&CK techniques this incident used - the real-world attacker behaviours you practised detecting.
The words this platform uses: A LAB is one authored incident, ready to work: its evidence, its objectives and its briefing. Labs live in the catalogue.; A RUN is one person's attempt at a lab. Starting a lab opens a run, and your runs are yours alone.; An EXERCISE is a facilitated session for a room: one shared environment, worked together, with a facilitator driving it. An exercise is not scored and produces no per-person measurement.; A CASE is the forensic record a run leaves behind, with its chain of custody. A CHALLENGE is one task inside a capture-the-flag lab.; A PATH is a set of labs in a deliberate order, with a note on each saying why it is there. There is nothing to join: a step counts as done once you have finished a run of that lab.; The word INCIDENT means the thing a lab is about, never the lab itself. If you are reading the API, a bundle or the database, a lab is called a scenario there: that is the internal name and the only place you will meet it.
Threat intelligence: Turning adversary behaviour into actionable intelligence: attribution, indicators, and hunting.
You can't change your own access: So a team always keeps at least one active administrator, you can't remove your own admin role or deactivate yourself. Ask another admin to make the change.
Your plan: What your organisation subscribes to, which decides the labs it can start: Standard opens the CloudLabs labs and a lab account of your own, Advanced adds the Training collection, and Enterprise adds labs your organisation writes for itself and single sign-on. The Academy's own labs are open on every plan.; Standard is bought on this page, monthly, by whoever administers your organisation or by the owner of a personal account. The price is shown in euro or in US dollars, whichever the switch above it says; a browser set up for the United States starts on dollars and every other on euro, and one click changes it. Payment is taken by card, by Stripe on its own page, and the plan is active the moment the payment is confirmed. Advanced and Enterprise are set up with Invictus through the contact page.; A plan bought here is managed through Manage billing, which opens Stripe's customer portal: invoices, the payment method, and cancelling at the end of the period. A plan Invictus set up is changed by contacting them. The platform holds no amount, card or invoice; every figure shown here is read from Stripe as you look.