The quiet hour
An authentication log from a made-up server, covering one night and the following morning. Somebody was patient. The volume is low enough that a rate…
Labs
6These run in your browser against artefacts we made up. Nothing here touches a real system, and no finding on this site is ever used as lab material.
Easy · 10 points
Easy · 15 points
A name that is nearly right
Five hostnames, as they would appear in a browser's address bar or in a link somebody sent you. One of them is not the name it looks like. It is a di…
Easy · 15 points
The one that asked once
A day of DNS queries from one office network. Nothing here is flagged, nothing is known-bad, and searching for something suspicious will not find it. …
Medium · 20 points
Forty alerts a day
A week of alert counts from four detection rules, with what each one turned out to be after review. One of these rules is actively harmful: it is tra…
Medium · 20 points
Two clocks disagree
A file's metadata from one workstation, and the firewall's record of what that workstation was doing. The file claims to have been created, modified …
Medium · 25 points
Who is really signing this?
SPF records for eight domains that send mail, with each one's DMARC policy underneath it. Seven of these domains would cause a receiving server to do…