Log Triage Practice: 7 Environments, Free Certificates

Every environment logs differently. An Android phone, a Kubernetes cluster, an infusion-pump server and an EV charger each have their own normal, and the attack hides in a different field each time. PlayCISO now lets you practise log triage in seven environments, with a graded scorecard for every shift and certificates you can prove.

The seven tracks

• SOC Log Triage: identity, endpoint, firewall, email, DNS and cloud logs in an enterprise SOC.
• Mobile (Android & iPhone): MDM, logcat and iOS logs. Sideloaded apps, unknown configuration profiles, push bombing, evil-twin Wi-Fi.
• Kubernetes & cloud-native: API audit, admission and runtime events. Privileged pods, cluster-admin bindings, secret reads, crypto-miners.
• Aircraft systems: the airline and airport side: electronic flight bags, software data loaders, cabin Wi-Fi and ground networks.
• Maritime & shipping: ECDIS, AIS, GNSS, satellite comms and port systems.
• Hospital & medical devices: EHR, imaging (PACS), HL7 interfaces and infusion pump servers.
• Connected vehicles & EV charging: telematics, over-the-air updates, the mobile app API and charger backends.

How a shift works

You get a stream of synthetic logs. Most are normal, and many attacks have a near-identical normal twin, so you have to read the fields rather than the headline. Click the fields that are red flags and check your call. The score is 60% red-flag recall and 40% precision, recalculated on the server from the flags you made. After the shift, a debrief explains each attack category, the first three response steps, and a deeper lab to practise next.

On the six new tracks, pick a tier: Trainee (1 in 5 logs hides an attack), Analyst (1 in 8) or Lead (1 in 14). Switch on the daily shift to play the same logs as everyone else that day.

Certificates you can prove

• Bronze: one graded shift.
• Silver: three shifts, an average of 70 or more, and one incident drill.
• Gold: five shifts, a best score of 85 or more, every attack category fully solved, and a shift on a harder tier.
• Capstone, Multi-Domain Log Analyst: Silver on the SOC trainer plus Silver on three other tracks.

PlayCISO issues a certificate only after checking your saved, server-scored shifts, and each certificate has a public page that lists those shifts as evidence. These are practice certificates, not accredited or proctored credentials.

Frequently asked questions

What is log triage?

Log triage is reading a stream of security events, deciding which are normal and which point to an attack, and naming the detail that gives it away. It is the core daily task of a security operations analyst.

Which environments can I practise?

Enterprise SOC, Mobile (Android and iPhone), Kubernetes and cloud-native, Aircraft systems, Maritime and shipping, Hospital and medical devices, and Connected vehicles and EV charging.

How do the certificates work?

Bronze needs one graded shift. Silver needs three shifts averaging 70 or more, including an incident drill. Gold needs five shifts, a best score of 85 or more, every attack category fully solved, and a shift on the Analyst or Lead tier. The capstone needs Silver on the SOC trainer plus Silver on three other tracks.

Are the logs real?

No. Every log is generated from templates with fictional devices, people and organisations, modelled on the fields real tools record.

Do I need an account?

No account is needed to play. Sign in to save shifts to your journey and claim certificates.