Labs

The catalogue

A lab is a self-contained, reproducible incident with its own telemetry, evidence and objectives. Labs are organised by track and difficulty so you can find work that matches your role and level. An exercise is something different: a facilitated session where a room works one shared environment together.

• DFIR - digital forensics and incident response.
• SOC - detection and triage from a defender's console.
• TI - threat intelligence and adversary tradecraft.

Delivery modes

The same catalogue is delivered three ways, so the platform fits both individual practice and team exercises:

• Self-paced labs - a personal incident injected just for you; work through it on your own schedule.
• Team purple-team - a shared, live range exercise run with your colleagues.
• Public CTF - challenge-style events built on pre-captured, frozen artefact sets.

Running a lab

When you start a run, the platform presents the incident's telemetry and evidence. Many labs replay a frozen dataset - a captured, anonymised artefact set - which makes them fast, repeatable, and identical for everyone, and build no environment at all: there is nothing to wait for and nothing to reclaim. Others lease an isolated environment for you and run against a live range for hands-on response practice.

All range-derived data you see is treated as untrusted input: it is sanitised on the way in and safely encoded in the interface, so a malicious log line in a lab cannot attack the platform or you.