Learn blue-team defense, hands-on
Free, open resources on detection and response: the concepts behind the ranges, the techniques adversaries use, and how to hunt them. No account required.
Foundations
The groundwork a blue-team analyst builds on: core security concepts, the vocabulary of detection and response, and how the pieces of a modern SOC fit together.
Explore →MITRE ATT&CK
The framework that maps how real adversaries operate. How tactics, techniques, and sub-techniques are organised, and how we use ATT&CK as the backbone of every scenario and detection.
Explore →How Our Ranges Work
A look under the hood of one of our ranges: the live, breached network you drop into, the telemetry it generates, and how a session goes from launch to auto-graded result.
Explore →TTP Catalog
A browsable reference of the adversary techniques our scenarios exercise: what each one is, how it looks in telemetry, how to hunt it, and which scenarios let you practice detecting it.
Explore →Incident Response
The lifecycle of handling a real incident (detection, triage, containment, eradication, and recovery) and how to apply it under pressure inside a range.
Explore →Reading the Telemetry
How to read the logs and events a range actually produces: what normal looks like, what an attack does to it, and the fields worth learning to trust.
Explore →Searching with KQL
Search the SIEM every range runs on the way an investigation does: set the time range, ask one precise question in KQL, pin what matters and pivot on what you find.
Explore →Your First Investigation
A start-to-finish walkthrough of your first session: launching a scenario, reading the briefing, how detections, objectives, tries, and hints actually work, and what to do when you get stuck.
Explore →AI in Network Defense
Where machine learning and AI genuinely help defenders, and where they fall short. Practical perspective on using AI in detection, triage, and hunting without outsourcing your judgment.
Explore →