CySA+ practice labs, one alert at a time
The CySA+ objectives expect an analyst who can work the daily queue: read a SIEM alert and an EDR detection, recognize an impossible-travel sign-in, triage a phishing report, correlate entities across host and log evidence, turn a confirmed behavior into a detection rule, and escalate a real incident with a severity verdict that holds up.
This pathway is the SOC queue in order. Four First Look cases cover the alert types an analyst sees most. Medium cases work an EDR detection to a verdict, an off-hours sign-in, a misdirected wire, a timed insider drill and a lateral move. The hard steps correlate a handset, an inbox and exchange logs on an account loss, then turn the lateral move into a detection rule. The capstone scopes a weekend of alerts end to end.
12 cases · ~13 h 12 min of lab time · Easy to Expert · a different variant for everyone · verified answer keys
The pathway, in order
12 cases, about 13 h 12 min of lab time. Each step opens the case in the library, where you can read the brief, the evidence list and sample questions. Everyone gets a different variant of the same case, graded against a key that was verified in the evidence.
-
01
First Look: Reading a SIEM Alert
Triage the SIEM alert queue: rule, severity, entities, technique.
EASY~33 minUp to 15 questions -
02
First Look: Reading an EDR Alert
Read an EDR alert and decide what it means.
EASY~33 minUp to 15 questions -
03
First Look: An Impossible-Travel Sign-In
Spot the impossible-travel sign-in in the cloud logs.
EASY~33 minUp to 15 questions -
04
First Look: Phishing Triage
Triage a phishing report end to end.
EASY~33 minUp to 15 questions -
05
Open the Ticket (Malware Triage: From Alert to Verdict)
Work an EDR detection from alert to a severity verdict.
MEDIUM~55 minUp to 20 questions -
06
Push Comes to Shove (Account Takeover: MFA Fatigue)
Rebuild an off-hours sign-in from logs, mail and a phone.
MEDIUM~1 h 15 minUp to 20 questions -
07
Wire Act (Business Email Compromise: Wire Fraud)
Trace a misdirected wire through mail headers and logs.
MEDIUM~1 h 20 minUp to 20 questions -
08
Last Day (Drill: Insider Exfiltration, 45 Minutes)
Timed drill: scope flagged outbound traffic against the clock.
MEDIUM~45 minUp to 20 questions -
09
Hands on Keyboard (Lateral Move to the File Server)
Correlate host and log evidence to track lateral movement.
MEDIUM~1 h 16 minUp to 20 questions -
10
Ported Out (SIM Swap to Empty Wallet)
Correlate a handset, an inbox and exchange logs on an account loss.
HARD~1 h 45 minUp to 25 questions -
11
Signature Move (Write the Rule: Catching Lateral Movement)
Turn that lateral move into a detection rule's fields.
HARD~1 h 30 minUp to 20 questions -
12
Low and Slow (The Long Quiet Weekend)
Capstone: scope a weekend of alerts end to end.
EXPERT~2 h 14 minUp to 30 questions
What this pathway covers
Who it's for
- Candidates preparing for the CySA+ who want graded practice on the analysis domain with real alert exports.
- Instructors teaching a SOC analyst or security operations course who need labs that fit a 50-minute class and grade themselves.
- Tier 1 analysts working toward tier 2 who want to prove they can correlate alerts, not only acknowledge them.
What you get with every case
- A different variant per student. Same case, same rubric, different names, hashes, timestamps and answers, so students can talk about method without sharing answers.
- Evidence in the real on-disk format. Registry hives, EVTX, PCAP, SQLite, JSON audit logs and memory images open in the tools the exam expects.
- A verified answer key. Every answer is re-derived from the planted evidence before the lab ships, so grading disputes end at the artifact.
- One-click grading and LMS export. Canvas, Blackboard, Moodle, D2L and LTI 1.3 grade passback, or a CSV. See the student portal.
- Runs on the instructor's machine. Windows installer plus macOS and Linux, fully offline after activation. Nothing to host and no student data leaves the room. Course packs on courses.
Run this pathway with your own roster
Download the app, generate a three-student version of the first case in under five minutes, and grade it. First Look cases run free with no key, and the 30-day trial needs no card. Or open the sample lab first and work a student package in your own tools.
Related pathways
Cloud & Enterprise IR (GCFR)
Investigating identity and cloud audit logs: sign-ins, token abuse, and data pulled from the cloud.
9 cases · ~13 h 17 min · GIAC GCFR
Advanced Forensics & IR (GCFA)
Memory, persistence, anti-forensics and full-intrusion timelines: the host-based incident-response capstone track.
7 cases · ~18 h 12 min · GIAC GCFA
All learning pathways
Every certification-prep and role pathway across Digital Forensics and Incident Response, side by side.
Browse the overview →
ATT&CK® and MITRE ATT&CK® are registered trademarks of The MITRE Corporation. Red Herrings maps to published ATT&CK tactics and techniques for teaching; it isn't affiliated with or endorsed by MITRE. GIAC, GCFE, GASF, GNFA, GCIH, GCFR and GCFA are trademarks of GIAC. CompTIA and CySA+ are trademarks of CompTIA, Inc. SANS is a trademark of the SANS Institute. Red Herrings aligns its pathways to the published objectives of these programs for teaching; it's independent of, and not affiliated with or endorsed by, any certification body.