Learn
How Our Ranges Work
Real incident response, not capture the flag
A lot of hands-on security training is built around capture the flag: solve a puzzle, find a hidden string, move to the next challenge. That's a legitimate skill in its own right, but it isn't incident response. Real IR doesn't hand you a puzzle designed to be solved. It hands you a network that got compromised, weeks or months of accumulated normal activity mixed in with the attack, and a job to reconstruct what actually happened from evidence that wasn't organized for your convenience.
That's what a scenario in this platform is. You're not solving a challenge someone built for you to solve. You're investigating a breach that already happened, using the same telemetry a real analyst would have, with the attack's actual traces sitting in the logs exactly as they landed. Nothing is staged in front of you. Everything you find, you find because it's genuinely there.
What you actually have access to
Every scenario gives you real telemetry, ingested into Elastic Security the same way a real enterprise's SIEM would receive it. What you get varies by scenario, shown as tags on each scenario card, but every tag maps to one of eight evidence families used across the whole platform:
Windows
Windows Event Logs: the built-in Windows auditing subsystem. Authentication events, account and privilege changes, scheduled task creation, and dozens of other categories, each with its own event ID. This is the same data every Windows-based enterprise generates by default, and the foundation most Windows-focused detection content is built on.
Sysmon
A Microsoft Sysinternals tool that logs far more detail than Windows auditing does on its own, especially process creation with full command lines and parent-child relationships, and registry modification, which matters directly for persistence techniques.
Linux
The Linux kernel's native audit framework (auditd), giving you the closest equivalent to Windows Event Logs: process execution, file access, and system-call level detail, shipped the way a real enterprise's endpoint agent would collect it.
Network
Zeek network traffic analysis: DNS queries, connection metadata, and protocol-level detail for what's actually moving across the wire, including application-layer log types like LDAP and database wire protocol that a full Zeek deployment captures alongside the more familiar connection and DNS logs. Commercial products like Corelight are built directly on Zeek, so this is genuinely production-grade network telemetry, not a simplified stand-in. Flow-level summary data (NetFlow) is also part of this family, useful when you need volume and pattern rather than full packet-level detail.
Suricata
A signature-based intrusion detection engine, running alongside Zeek rather than instead of it. Where Zeek gives you rich, queryable network metadata for hunting after the fact, Suricata inspects traffic against known-bad patterns in real time and generates an alert the moment something matches. Most mature SOCs run both for exactly that reason.
Web logs
Web server and web application logs: access logs, application-level request logs, and database audit logs where a scenario's evidence trail runs through a backend database rather than just the web tier.
Mail server telemetry: delivery and policy logs from the mail transfer agent, plus mailbox access logs from the IMAP server. This is its own category because mail evidence behaves differently enough from everything else (its own authentication model, its own timing quirks, its own gaps) that folding it into another category would misrepresent what's actually there.
Proxy
A forward proxy's own access log: a record of every outbound request leaving the organization, written by the device that handled it. This is its own category because a proxy is a participant in the traffic rather than an observer of it. It can refuse a connection, and when it does, the refusal is recorded as its own outcome rather than as an absence. Web server logs record requests arriving at something you run, and network capture sees the traffic but not the decision made about it, so neither can tell you a control actually acted.
All of it lands in Elastic Security, one place regardless of which host, platform, or evidence family generated it. You investigate everything from the same interface, the way a real analyst does.
Why this specific data, and not something else
This isn't an arbitrary choice. Commercial EDR and SIEM products, Microsoft Defender for Endpoint, CrowdStrike, and the rest, aren't built on top of Windows Event Logs and Sysmon in any literal sense. They have their own sensors and their own architecture. But they collect, and go well beyond, similar classes of endpoint telemetry that Sysmon popularized, tapping overlapping low-level Windows facilities to get it. The same relationship holds on the network side: Corelight's commercial sensors are built directly on Zeek.
That overlap is what matters for what you actually learn. Getting comfortable in one vendor's proprietary console teaches you that vendor's console. Getting comfortable reading the underlying telemetry classes, process creation with full lineage, authentication and privilege-change events, memory access patterns, network-layer metadata, teaches you the categories of signal every one of those products is built around interpreting, which means the skill transfers regardless of which specific tool you end up using on the job.
How a scenario is built
Every scenario draws from one complete, continuously running environment rather than a network assembled just for it: domain controllers, a mail server, web and application servers, a database server, a file server, a jump host, and workstations, all with their own genuine day-to-day activity, ordinary logons, routine file access, normal mail flow. An attack runs against that real environment, and your scenario is the slice of it relevant to that incident, not a synthetic subset built to make a point.
That ordinary background activity matters as much as the attack itself. A range with nothing in it but the incident would make the signal trivially obvious. Finding it against real, everyday noise is the truer test, and the same reason a signal you find here won't feel like it was left for you to find.
Size and complexity scale with difficulty. An easier scenario might be a single host with a focused, contained incident to untangle. A harder one spans multiple hosts, with an attack chain that moves across several of them, mirroring how a real intrusion actually spreads rather than staying conveniently in one place. Either way, the attack itself is based on real, documented adversary tradecraft mapped to specific MITRE ATT&CK techniques, not a hypothetical or simplified version of one.
By the time you launch the scenario, the attack is already over. You're not watching it happen live or reacting to it in real time. You're doing exactly what a SOC analyst does after the fact: given access to the telemetry, reconstruct what an adversary did, when, and how, then answer specific objectives about it, the same way you'd write up findings for a real incident.
Where to go from here
The TTP Catalog is your reference for the specific techniques you'll encounter: what each one looks like in this exact telemetry, which fields to check, and how to tell a real attack from something that merely looks like one. It works two ways. If something's already fired and you need to triage it, the catalog tells you what you're looking at. If nothing's fired and you're proactively hunting, its guidance is written for exactly that case too, what to go looking for even with no alert to start from. That second use is the one that matters most once you're actually in a range: real intrusions don't announce themselves, and neither do these. Incident Response walks through the actual investigative process end to end, from initial framework to hands-on work in Elastic. Between the two, you'll have both the map and the process for whatever a scenario throws at you.
Where to go from here
Curious what this actually looks like? Launch a range and see it live.
Launch a range →