Practice Labs
Start with your first Splunk search and learn to investigate suspicious activity yourself. Try a free live introduction, then continue with guided lessons and feedback through a paid programme. Keep your searches, timelines and reports to explain in interviews.
Inside your lab
Your environment opens in the browser. Use the SIEM, inspect endpoints, ask for guidance and record your findings as you work.
Work with Active Directory, Windows workstations and Splunk on cloud infrastructure. Ordinary logins, file activity and process events sit alongside the incident, so you practise separating suspicious activity from everyday noise.
Investigate activity across hosts and users: suspicious logins, malicious file execution, phishing traffic and insider threats. As you progress, the advanced labs introduce autonomous adversary investigations.
The AI lab assistant uses your lab context to help you reason through the next step. Ask about a log field or SPL query, then work through a nudge, a guide or a more detailed walkthrough.
SOC foundations
Five course labs build on each other. Start with Splunk First Steps for free, then continue through Windows logs, detections, a full insider threat investigation and the malicious-file-execution capstone. Your free account also includes the introductory live class; the dashboard shows its date and invitation status.
Search a real Splunk index and answer the first questions a SOC asks of a log.
Read Windows security and Sysmon events well enough to spot a logon that should not be there.
Write your own SPL to hunt across hosts and users instead of clicking through alerts.
Run a full insider-threat investigation on a live domain: build the timeline, state the affected scope and write the escalation handoff.
Capstone. Trace a malicious file from download to execution across endpoint and SIEM telemetry, then write the incident report. Submit your report for assessment toward the CymBytes SOC L1 Certificate.
Scoring and evidence
Scored checkpoints assess the queries you run and the evidence you collect. Your incident timeline and report show how you reached a conclusion, alongside the time taken at each stage.
Use your session reports to review strengths, find gaps and explain your lab work in interviews.
Submit an incident report and earn a final score of 70 or more in each of the five required foundation labs, with a plan that includes the certificate. Issued by CymBytes for assessed lab performance. Its public verification link records the completed labs and scores.
Example lab investigation · report excerpt
This example comes from the incident timeline shown on this site. The account and events belong to the lab scenario.
The session report separates correctness, speed and process, alongside checkpoint results and the incident timeline. Use these to review the evidence found, the steps taken and where another attempt would help.
A score describes performance in that lab. It is not a probability of getting hired or a measure of professional seniority. This excerpt shows the investigation record, not an overall score.
Use the labs independently, or join the live programme for scheduled sessions with the instructor. The programme page has the curriculum, timetable and fees.
“Building practical learning environments that help people move from saying ‘I know the concept’ to ‘I have actually worked with it’.”
