Cyber Defense Lab: SOC Analyst

Cyber Defense Lab is a blue team cyber security game where you work as the SOC analyst on shift. An alert fires, the clock starts, and you decide how to contain the incident: quarantine the phishing mail, isolate the infected laptop, block the attacker's IP, reset the stolen account. Every move changes the containment meter, and waiting too long lets the breach grow.

It is a cybersecurity simulator for people who want to practice incident response by doing it, not by reading slides. No prior security experience is needed: a guided mode offers three possible moves at each step, and you can switch to typing your own move whenever you are ready.

HOW AN INCIDENT WORKS
• Read the briefing and the live alert feed, the same kind of signals a SOC analyst sees in a SIEM.
• Type a defensive action in plain words in the console. A rule engine understands clear commands, and an AI assist helps with the rest.
• Watch containment rise as you make the right calls. Wrong moves cost time, and slow responses can escalate the incident.
• Lose volatile evidence or act on a false positive and your grade shows it.
• Finish with an after-action report: grade, time to contain and what cost you the most.

28 INCIDENTS ACROSS 8 ATTACK TYPES
Phishing, ransomware, malware, insider threats, data breaches, network intrusions, supply chain attacks and DDoS. You will face an invoice phishing wave, a VPN password spray, ransomware on a file server, a poisoned dependency, DNS tunnel exfiltration, a hidden mail forwarding rule and more. The first 3 incidents are free.

THE SOC BENCH
Between incidents, sharpen your blue team skills on the Ops bench:
• Alert Queue: work a triage queue against the clock. Escalate, correlate or close the noise.
• Threat Hunt: query a raw log corpus and find the beacon nobody alerted on. Real threat hunting starts with log analysis.
• Detection Rules: write a rule from what you found, replay it over past incidents and see what it catches.
• Reported Mail inbox: swipe through reported emails and decide which are phishing.
• Spread Sandbox: drop an attack into a small office network, watch it spread and cut machines off to stop it.
• Muscle Memory drills: 90 seconds of reps built from the calls you keep getting wrong.
• Incident Forge: build an incident from templates and send a colleague the code.

STORY MODE
A 10-chapter investigation. Compare logs, follow the timeline and work out what really happened. The first 3 chapters are free, and a wrong answer lets you retry with a hint.

THE PLAYBOOK
A security analyst reference for every attack category and defense technique: what it is, common signs, how to defend, first actions and the evidence to collect for digital forensics. The essentials are free; the full field notes are part of Pro.

BUILT FOR BEGINNERS
• Ask a senior analyst when you are stuck.
• Rewind a move, at a cost on the incident clock.
• Jargon Buster saves every term you open, from EDR to lateral movement.
• One recall question a day from your last incident.
• A first-week roster to build the habit, plus an optional on-call pager and a daily reminder at the time you choose.

WHO IT IS FOR
• Beginners curious about how cyber defense works in a real security operations center
• Students and career changers exploring blue team and SOC analyst roles
• IT and network staff who want hands-on incident response practice
• Anyone who enjoys a tense simulation game

FREE AND PRO
Cyber Defense Lab is free to start and shows ads. Pro unlocks all 28 incidents, all 10 story chapters, unlimited drills on the Ops bench and the full playbook, with no ads.

GOOD TO KNOW
All incidents are fictional training scenarios. Cyber Defense Lab does not scan or protect your device, and it is not an official certification. The app and its incidents are available in 10 languages.

Privacy Policy: https://coddykit.com/terms/privacy-policy

Recent changes:
New in 1.9:
• Fixed: opening an incident could crash the app
• New to a SOC? Guided mode, a Reported Mail inbox, a jargon buster, tips from a senior analyst and a daily recall question
• Story mode: the first 3 puzzles are free, and a wrong answer lets you try again
• Choose your reminder time, a fully translated playbook and new plan options