SOC Analyst · Scenario 01
Suspicious Activity on a Finance Laptop
An EDR alert just fired on FIN-LT-042. Triage it, investigate the endpoint, correlate evidence, contain the threat and report your findings — across six stages, scored out of 100.
Start SimulationEDR alerts & process trees
Network & auth telemetry
Evidence & incident timeline
Decisions with consequences
All data is fictional. No real systems are contacted and no commands are executed.
Who is Cimulate for?
Built for the people who work incidents
Aspiring SOC Analysts
Practise alert triage, endpoint investigation, and incident response.
Cybersecurity Professionals
Practise evidence correlation, containment, and escalation decisions.
Students, Trainers & Career Switchers
Explore SOC workflows in a safe, interactive environment using fictional data.
What you'll learn
The investigation skills the job actually runs on
Alert triage & endpoint investigation
Work an EDR alert from first signal to a confirmed compromise on the host.
Multi-source evidence correlation
Tie together email, network, DNS and authentication evidence into one picture.
Containment & escalation
Decide how far to contain, when to escalate, and what each choice costs.
Documentation & review
Write up the incident and assess your response decisions against the evidence.
More simulations on the way
New role-based scenarios and decision-making challenges are planned.
SOC Managers
Queue triage, staffing and hand-off pressure.
CISOs
Risk, communication and board-level trade-offs.
IT Professionals
Detection gaps and remediation follow-through.
Planned only — Scenario 01 is the simulation available today.