Run scored IR drills on your own evidence formats
A drill plan from First Look triage to a full intrusion, the MITRE ATT&CK techniques it exercises, and how to run a timed, scored exercise. Each analyst gets a different variant of the same incident, so nobody can read answers off a neighbor's screen.
The drill plan
11 cases, about 15 hours in total. Run one a week or one per on-call rotation. 3 run free on download and the trial opens 2 more (Phishing to Foothold and Phishing to Malware to Command and Control), so you can take a phish from the first alert to command and control before you buy.
Free runs on download with no key. Trial opens with the 30-day trial key. Paid plan needs a license; a plan name such as Department means that plan or above.
| Case | Level | Time | ATT&CK tactics | Access |
|---|---|---|---|---|
| First Look: Reading an EDR Alert Triage your first EDR detection: process tree, technique, severity. | First Look | 33 min | Execution, Persistence, Privilege Escalation, Defense Impairment | Free |
| First Look: Reading a SIEM Alert Read a SIEM alert queue and find the one that matters. | First Look | 33 min | Execution, Credential Access, Discovery, Command & Control, Exfiltration | Free |
| First Look: Phishing Triage Work a reported phish: header, link and payload. | First Look | 33 min | Initial Access | Free |
| Phishing to Foothold Follow the phish through to the payload running on the host. | Medium | 1 h | Initial Access, Execution, Command & Control | Trial |
| Phishing to Malware to Command and Control Follow a host from an opened document to its outbound traffic. | Hard | 2 h 39 min | Initial Access, Execution, Persistence, Privilege Escalation, Command & Control | Trial |
| Drill: Insider Exfiltration, 45 Minutes Timed drill: scope flagged outbound traffic against the clock. | Medium | 45 min | Exfiltration | Paid plan |
| Lateral Move to the File Server Trace a remote session back to its source. | Medium | 1 h 16 min | Execution, Persistence, Privilege Escalation, Discovery, Lateral Movement | Paid plan |
| Ransomware Precursor: Caught Mid-Setup Read logs, registry and memory on a server caught before impact. | Hard | 2 h 14 min | Initial Access, Persistence, Privilege Escalation, Stealth, Defense Impairment, Lateral Movement, Collection, Exfiltration | Paid plan |
| Drill: Ransomware, 45 Minutes Timed drill: triage a live ransomware outbreak in 45 minutes. | Hard | 45 min | Execution, Defense Impairment, Credential Access, Command & Control, Impact | Paid plan |
| Ransomware Before Coffee A live ransomware outbreak worked from the EDR feed. | Hard | 1 h 15 min | Execution, Defense Impairment, Credential Access, Lateral Movement, Command & Control, Impact | Paid plan |
| Operation Nightfall Capstone: run a hospital-wide incident through every NIST phase. | Expert | 3 h 14 min | Initial Access, Execution, Defense Impairment, Credential Access, Lateral Movement, Collection, Command & Control, Exfiltration, Impact | Department |
ATT&CK coverage
The plan touches 13 of the 15 Enterprise tactics through 15 techniques. The table counts the cases in the plan that exercise each tactic; the ATT&CK page covers the whole library.
| Tactic | Cases in the plan |
|---|---|
| Initial Access | 5 |
| Execution | 8 |
| Persistence | 4 |
| Privilege Escalation | 4 |
| Stealth | 1 |
| Defense Impairment | 5 |
| Credential Access | 4 |
| Discovery | 2 |
| Lateral Movement | 4 |
| Collection | 2 |
| Command & Control | 6 |
| Exfiltration | 4 |
| Impact | 3 |
Running a scored exercise
Set it up
On Home, choose “I train a security team” and Generate starts at 8 analysts, exam mode, a 45-minute clock and integrity mode on. Change the headcount and clock to fit your shift. Hand out the portal link; analysts work the evidence in the tools they already use and answer in the browser.
Integrity logging
In exam mode the portal records tab switches, full-screen exits and pastes for each analyst, with times, so a score you report up the chain comes with evidence it was earned under exam conditions.
When the clock stops
A leaderboard ranked by score, then time. The hardest questions sorted by correct rate, with the most common wrong answer, so the debrief starts at the gap. Containment calls are graded too: who isolated the host, who scanned it, who emailed the user.
What you keep
A completion certificate per analyst, and the drill's indicators exported as STIX 2.1 and CSV for your own detection content. Everything runs on your machines; no evidence leaves the network.
Run the first drill this week.
The trial opens the phishing-to-C2 cases for 30 days, for up to five analysts. First Look stays free.