Incident response you can actually run
Dozens of the cases are full incident response investigations, worked from the feeds a responder works from. Every case is mapped to MITRE ATT&CK and tagged with the NIST 800-61 phases.
Incident response cases · mapped to MITRE ATT&CK · tagged by NIST 800-61 phase · graded on your machine
What makes an incident-response case different
A forensics case hands you an image and asks what happened. An IR case drops you into a live incident with a responder's tooling and a responder's clock.
Worked from the responder's own tooling
Students start where a responder starts: an EDR detection feed (edr/detections.json and a matching CSV) and a SIEM alert export (siem/alerts.json and CSV), corroborated by host event logs. They triage the detections, pivot into the alerts and confirm against the logs. There's no narrated story, only what a SOC actually sees.
Mapped to ATT&CK, tagged by NIST phase
Every case declares the MITRE ATT&CK tactics and techniques it exercises, and every question carries its NIST 800-61 phase: detection and analysis, containment, eradication, recovery or post-incident. Pick a case by the behavior you want learners to recognize, and grade whether they named the right technique and made the right call at the right phase.
Time pressure that teaches, plus a real timer
Each case carries an in-world response clock, the incident unfolding host by host, so learners feel why sequence and triage matter. An optional instructor timer adds timed or exam mode with a server-enforced countdown. One is the story; the other is the stopwatch.
Answer types that make incident response gradable
IR has never graded cleanly as free text. Alongside the usual text, hash, timestamp, IP and domain types, these answer types let a machine score triage judgment as fairly as a hash.
MITRE ATT&CK, parent-aware
Name the technique behind an observed behavior. A sub-technique answer is matched against its parent, so a broader but reasonable answer earns credit instead of a flat zero.
IOC, set-graded
Pull the indicators worth escalating, the hashes, IPs and domains, from the feeds and submit them as a set. The grader scores completeness and precision, rewarding the full picture over one lucky line.
Sequence, ordered with partial credit
Put the stages of the attack, or the steps of the response, in order. Partial credit means a learner who gets the shape right but swaps two steps isn't scored like one who guessed.
Severity and boolean calls
Rate the severity, or answer the yes/no containment question. These are the decisions a responder is paid to get right, and they score automatically against the key.
Learning pathways aligned to the certifications employers ask for
Filter the library by the certification you're preparing for. Each pathway follows that certification's published objectives.
Incident Handling
GIAC GCIH: the full detect-to-recover lifecycle across the EDR and SIEM feeds, from first alert to post-incident write-up.
SOC Analyst & Triage
CompTIA CySA+: alert triage, detection analysis and escalation, the daily work of the analyst at the console.
Cloud & Enterprise IR
GIAC GCFR: responding across cloud audit logs and enterprise telemetry, where the evidence is spread across services.
Advanced Forensics & IR
GIAC GCFA: deep host and memory analysis tied into the response, for the toughest capstones. A dedicated Ransomware Incident Response role path runs a double-extortion campaign end to end.
Different for every student, verified before release
An incident only teaches if the answer can't be shared. Each IR lab is built from its own seed and proven before it reaches a student.
A different incident for every student
Hostnames, users, timestamps, IPs, hashes and the answers themselves change per student. No two people work the same detection feed, so a copied IOC or borrowed ATT&CK technique is the wrong answer for that student.
Independently re-solved and verified
Every variant is re-solved before release: the green Verified check. A fact that can't be found in that student's own feeds is flagged before the lab goes out.
The answer key never reaches the browser
Grading runs on your machine, server-side, and the answer key never reaches the responder's browser.
Run a real incident with your class
The incident-response First Look cases are free to run, and a 30-day trial adds sample cases from the paid library. Nothing to host.
ATT&CK® and MITRE ATT&CK® are registered trademarks of The MITRE Corporation. Red Herrings maps to published ATT&CK tactics and techniques for teaching; it isn't affiliated with or endorsed by MITRE.