Incident drills your analysts can’t rehearse for
Tabletop exercises test the plan. Red Herrings tests the people. Each analyst works their own variant of a real incident from the EDR console and SIEM export, on a clock you set, scored on MITRE ATT&CK and the NIST 800-61 phases.
Built for the SOC calendar
A drill is a case with a clock. The lead picks one, sets the roster, and sends each analyst a private link. When time is up, the results are on one screen.
First Look: Reading an EDR Alert
The warm-up for new hires: triage a short stack of detections by severity, read the process tree and the technique, and decide if it's real. Try it in your browser now.
Drill: Insider Exfiltration
An egress capture and browser history from a departing employee's workstation. Who, where, how much, when, and what to do before anyone talks to the employee.
Drill: Ransomware
EDR detections and SIEM alerts from a live encryption chain. Scope it, pull the indicators, map it to ATT&CK, and make the containment and communication calls in NIST order.
Every incident-response case in the library runs as a drill: set the timer at generate time. Browse the incident response cases or the ATT&CK coverage.
What the lead sees when the clock stops
This isn't a pass/fail result. It's a per-analyst, per-question picture of where the team is fast, where it's slow and which containment calls went wrong.
Leaderboard
Score, then time. Ties share a place. Names can be hidden for the debrief.
Hardest questions
Sorted by correct rate, with the most common wrong answer, so the debrief starts at the gap.
Containment calls
Judgment questions are graded too: who isolated, who scanned, who emailed the user.
Certificates and IOC export
A completion certificate per analyst, and the drill’s indicators as STIX 2.1 and CSV for your own detection content.
Why it works for teams, not only classes
The engine that stops students copying stops analysts comparing notes. Each variant has its own hosts, users, times, hashes and indicators, so the drill measures each person.
Runs where your evidence lives
A desktop app for Windows, macOS and Linux. Generation, the analyst portal and grading never make a network call, so it runs on an air-gapped SOC floor.
Your tooling, not a simulator
Detection feeds, SIEM exports, event logs, memory images and PCAPs in their real formats. Open them in the tools your team already runs.
Author your own drills
Turn last quarter’s real incident into next quarter’s drill in the Scenario Editor. The verification check proves every answer before anyone sits down.
Plans for security teams
Commercial use, CTF mode and the Scenario Editor are included. Buy by card or purchase order.
Team
Security teams training analysts. Five-seat minimum, $9,950 a year.
- Commercial use rights
- 100 participants per drill, timed drills and CTF mode
- Scenario Editor, every case including Expert capstones
- 25-seat site license: $19,900 a year, priority support
Pro
Training companies, MSSPs and resellers
- 3 seats, unlimited participants
- Full white-label
- Author and resell packs
- 1 business day support
Enterprise is $25,000 a year for one site with unlimited seats, an on-premises license server, air-gapped activation and an SLA. Government, defense and multi-site buyers: talk to us.
Run the first drill this week.
The incident-response First Look cases are free forever. The 30-day trial adds two more incident-response cases, with five analysts per drill. No account or card required, nothing to host.