All labs
Every hands-on lab in the catalog. Prefer a guided route? Browse learning paths.
Windows Hardening: Turn On the Records You Will Need
A Windows machine records surprisingly little by default. See how an administrator turns on the records defenders need, and what the free Sysmon tool adds.
Patching and Vulnerability Management: Find, Rank, Fix, Check
Hardening shrinks the attack surface; vulnerability management finds what is still weak. Learn how teams find missing patches, rank them by risk, fix them and prove the fix.
Linux Hardening: Measure, Fix, Measure Again
Measure a Linux server with an audit tool, read what it finds, see how an administrator hardens SSH and turns off unused services, then measure again to prove it worked.
What Hardening Is: Four Habits That Shrink the Attack Surface
Why new computers usually arrive more open than they need to be, and the four habits defenders use to close them up.
Capstone: Audit a Server and Write the Fix List
Deploy a real server, audit it as a defender without changing anything, find the settings an administrator must fix, write the fix list in risk order, and capture the audit flag.
Threat Hunting Fundamentals: Hunt from a Baseline
Your first real hunt: one hypothesis, one written baseline, and a server that is talking to somewhere it never should.
Capstone: Find the Undetected Intrusion
One warning from a partner, no alert anywhere. Pivot from clue to clue across three data sources to the first infected machine, then make sure this never goes unseen again.
Thinking Like a Threat Hunter
Why alerts miss real intruders, and how a hunter goes looking anyway: a hypothesis, the right data, a picture of normal, and an eye for the rare.
MITRE ATT&CK for Defenders
Use MITRE ATT&CK as a shared language for attacker behaviour: read its IDs, map what you see in the logs to a technique, and measure where your detections are missing.
Hunting in Endpoint Logs
Rules catch what you already know to look for. Hunting looks for what they missed, starting from a written hypothesis, and ends by turning what you found into a new rule.
Testing and Tuning Detections
Prove a rule fires on the real thing and stays quiet on normal work, tune it without opening blind spots, and keep every rule tested and reviewed as code.
Detection Engineering Basics: From Telemetry to Alert
What a detection engineer does, where the data comes from, how one event becomes an alert, and the four ways a rule can be right or wrong.
Capstone: Test, Tune and Map a Detection
Deploy a real lab, test a draft Sigma rule against recorded endpoint telemetry, tune out the documented false positive, confirm the true positive, update the ATT&CK coverage, and capture the flag.
Writing Detections with Sigma Rules
Write a detection once in Sigma, an open rule format, then turn it into a query for whichever SIEM you run.
Detecting a Multi-Stage Intrusion
Real intrusions are sequences. Follow one recorded intrusion through three stages, see exactly which events each stage leaves, and turn every stage into a detection.
Hunting a Specific ATT&CK Technique: Valid Accounts
Take one named ATT&CK technique, learn what its normal use looks like, and add context until the one misused account stands out.
Triage and Live Response
Read the collection a responder took from a live, compromised workstation, check it has not changed, and find how the attacker made sure they would come back.
Memory Forensics: Find the Process That Does Not Belong
Read the reports a memory-forensics tool produced from a compromised workstation and find the process the attacker took over, using its parent, its command line, injected code and its connections.
Disk and Timeline Forensics
Read the timeline an analyst built from a compromised workstation's disk, narrow it to the minutes that matter, and find the file where the intrusion began.
DFIR Fundamentals: Events, Incidents and the Response Lifecycle
What digital forensics and incident response are, how an event becomes an incident, and the six phases a team follows from the first alert to the lessons learned.
Handling Evidence: Volatility, Copies, Hashes and Custody
The rules that make digital evidence trustworthy: collect the most fragile first, work on copies, prove nothing changed with a hash, record who held it, and write down everything you do.
Capstone: Reconstruct the Intrusion
A new incident, a full evidence set, and one question: what happened? Verify the evidence, rebuild the story, prove each finding twice, recommend what to do, and capture the case flag.
What a SOC Does
What a Security Operations Center does all day, how an alert moves through it, who does which job, and why the logs come first.
Reading Windows Logs and Sysmon
Read Windows like a Tier 1 analyst: who signed in and how, which accounts changed, what program started what, and how to line the events up in time.
Reading Linux, Firewall and Web Logs
Where the most useful Linux, firewall and web server logs live, how to read one line of each, and the patterns a Tier 1 analyst looks for.
How a SIEM Works: Agents, Decoders and Alerts
How logs from hundreds of machines reach one screen, how plain text becomes searchable fields, and how to read one alert record from top to bottom.
Escalation, Triage Notes and Handover
What happens after the disposition: when to escalate, how urgent it is, how to write a note the next analyst can act on, and how to hand a shift over without losing anything.
Dashboards and Alerts: Reading the SIEM
See the shape of activity at a glance on a dashboard, then read what makes one alert more urgent than another: its rule, level, group and frequency.
Capstone: Your First Shift on the Queue
Deploy a real lab, work a queue of three alerts as the Tier 1 analyst on shift, give each the right disposition, escalate the true positive and capture the escalation flag.
Alert Triage: True or False Positive?
The core Tier 1 skill: take one alert, pull out its facts, check them against other logs and context, and reach a clear disposition.
Capstone: Work an Intrusion End to End
One new alert, the whole SIEM, and you. Confirm the intrusion, scope every host and account it touched, find where the infected machines report to, and recommend containment.
SIEM Fundamentals: From Event to Search
Follow one event from the machine that wrote it to the alert an analyst sees, then search real SIEM data yourself: filter it, count it, and find who is behind a burst of failed logons.
Windows Event Logs and Domains
Windows writes down what happens; learn to read the logon events defenders check every day, and what a domain is.
Windows Accounts, Groups and Services
How Windows keeps track of who you are, which accounts are powerful, and the programs that run in the background.
What a Port Scan Shows
See one basic port scan of a Purple Edge lab host, read what it found, and decide what each open port means for the people defending that host.
Security at Work: Policies, Risk and Incidents
How organisations run security: the rules they write, how they weigh risk, what happens during an incident, and who does which job.
Scripting Basics: Read and Change a Short Script
Read a short bash script and a short Python script that count failed logins in a log file, change one value in each, and predict what changes.
How Passwords Are Stored: Hashing in Plain Words
Why a well-built website never keeps your actual password, what it keeps instead, and how to tell a strong storage method from a weak one.
Packets, Ports and Protocols
How data really travels: packets, the two main delivery styles (TCP and UDP), private address ranges, and the ports you will see everywhere.
Linux Users, Groups and Processes
Who you are on a Linux machine, which groups you belong to, what is running, and why everyone should have only the access they need.
Linux Files and Permissions
Read the permission string on any Linux file, know who can read, change or run it, and why a wrong permission is a security problem.
How the Web Works: Requests, Cookies and Sessions
What really happens between your browser and a website: requests, responses, cookies that remember you, sessions that keep you logged in, and why most web bugs start with trusting input.
Finding the Scan in the Logs
The same scan from the last lesson, seen by the machine that was scanned: find its traces, match them by time and source, and decide what to do next.
Encryption and HTTPS in Plain Words
How encryption keeps secrets secret, the two kinds of keys, and what the padlock and certificate warnings in your browser are really telling you.
DNS and HTTP from Both Sides
Watch one web visit twice: from the client that asks, then from the server that answers and writes it down.
Capstone: Follow One Incident from Attack to Log
Deploy a real lab, read what an attacker did to one machine, find every action in the logs, name the account that was taken over, and capture the case flag.
Log Sources, Coverage and Dashboards
You cannot detect what you do not collect. Check which log sources the SIEM should have, which are actually sending, which are silent, and which send events the SIEM cannot read, using a source inventory and a simple dashboard.
Writing, Tuning and Correlating Detection Rules
Turn a behaviour into a detection rule, see why the first version drowns analysts in noise, tune it without going blind, combine two signals into one strong alert, and map it to MITRE ATT&CK.
Alert Triage and Investigation
Work an alert queue like a SOC analyst: gather context before judging, decide true or false positive with evidence, pivot from one record to the next, and build the timeline of what happened.
What Is Cybersecurity?
What cybersecurity protects, who it protects it from, and why it affects everyone, not just experts.
Using the Purple Edge Lab
A guided tour of the lab experience: deploy, open the console, watch the timer, submit an answer, and end the lab.
Networks and the Internet
How computers talk to each other: networks, IP addresses, ports, DNS, and what really happens when you open a website.
How a Computer Works
The parts of a computer that matter for security: the operating system, files and folders, users and permissions.
Ethics, Permission and Safe Practice
The most important rule in security: only test systems you have clear, written permission to test.
Common Threats in Plain Words
The handful of threats behind most real incidents, and the simple habit that defends against each.
Your First Linux Commands
What a terminal is, why security people use it, and six safe commands to find your way around a Linux machine.
The CIA Triad: Confidentiality, Integrity, Availability
The three goals of security: keep secrets secret, keep data correct, keep services running.
Capture Your First Flag
Deploy your first real lab machine, use six simple commands to follow a trail of notes, and capture a hidden flag.