SOE
sign in

Security Operations Environment

Practise the job, not the vocabulary.

SOE hands you a queue of alerts on a simulated company estate, and asks the question a real shift asks: what is this, and what are you going to do about it? You investigate real telemetry, decide, write it up, and get marked on how you worked — not just on what you concluded.

Sign in Accounts are issued by an administrator.

Who it is for

Aspiring, junior and early-career SOC analysts; students and career-changers who can pass a quiz about the kill chain and have never had thirty alerts and two hours. If you have the knowledge and not the reps, this is the reps.

A shift, end to end

  1. The page arrives

    A detection fires on the estate and a case lands in your queue with an SLA against it. Several may be open at once.

  2. You investigate

    You search the company's real logs — Windows security, Sysmon, the change feed — and pivot on what you find: an address, an account, a process, the asset inventory.

  3. You reconstruct

    You build the chronology yourself. Nothing auto-populates it; that reconstruction is the exercise.

  4. You decide and write it up

    Disposition, severity, whether it escalates, what you cite, what you recommend. In the words you would hand to the next shift.

  5. You are marked on the work

    Not only on the verdict. Which pivots you actually performed is read back from the evidence system's own audit trail — so the score reflects how you investigated, and it can tell "you did not do this" apart from "we could not measure it".

How this differs

Not a course
There is no lesson to finish and no video to watch. The estate carries ordinary company activity every day; you are given alerts against it and judged on the decisions you make.
Not a CTF
Nothing is hidden for you to find and there is no flag. Most of what fires is benign, and saying so with evidence is the correct answer — the judgement a capture-the-flag can never ask for, because in a CTF something is always there.
Not a sandbox to poke at
You work a queue against a clock, on a company with a history — staff who join and leave, machines that are decommissioned, maintenance that explains what looks alarming. Context is something you go and check.

What it is honest about

The estate is generated, and it says so. The value is not that the logs are somebody's real breach — it is that the workflow is real: a queue, a clock, an evidence system you have your own account on, a write-up, and a mark you can argue with. Every score names what it measured and what it could not.