# Log Triage Practice: 7 Environments, Free Certificates

> Practise log triage on synthetic logs from SOC, mobile, Kubernetes, aircraft, ships, hospitals and connected vehicles. Earn Bronze to Gold certificates.

Source: https://playciso.com/blog/log-triage-practice-mobile-kubernetes-hospital-vehicles · Published: 2026-10-31 · Publisher: PlayCISO (https://playciso.com)

---

Every environment logs differently. An Android phone, a Kubernetes cluster, an infusion-pump server and an EV charger each have their own normal, and the attack hides in a different field each time. PlayCISO now lets you practise log triage in seven environments, with a graded scorecard for every shift and certificates you can prove. ## The seven tracks - SOC Log Triage: identity, endpoint, firewall, email, DNS and cloud logs in an enterprise SOC. - Mobile (Android & iPhone): MDM, logcat and iOS logs. Sideloaded apps, unknown configuration profiles, push bombing, evil-twin Wi-Fi. - Kubernetes & cloud-native: API audit, admission and runtime events. Privileged pods, cluster-admin bindings, secret reads, crypto-miners. - Aircraft systems: the airline and airport side: electronic flight bags, software data loaders, cabin Wi-Fi and ground networks. - Maritime & shipping: ECDIS, AIS, GNSS, satellite comms and port systems. - Hospital & medical devices: EHR, imaging (PACS), HL7 interfaces and infusion pump servers. - Connected vehicles & EV charging: telematics, over-the-air updates, the mobile app API and charger backends. ## How a shift works You get a stream of synthetic logs. Most are normal, and many attacks have a near-identical normal twin, so you have to read the fields rather than the headline. Click the fields that are red flags and check your call. The score is 60% red-flag recall and 40% precision, recalculated on the server from the flags you made. After the shift, a debrief explains each attack category, the first three response steps, and a deeper lab to practise next. On the six new tracks, pick a tier: **Trainee** (1 in 5 logs hides an attack), **Analyst** (1 in 8) or **Lead** (1 in 14). Switch on the **daily shift** to play the same logs as everyone else that day. ## Certificates you can prove - Bronze: one graded shift. - Silver: three shifts, an average of 70 or more, and one incident drill. - Gold: five shifts, a best score of 85 or more, every attack category fully solved, and a shift on a harder tier. - Capstone, Multi-Domain Log Analyst: Silver on the SOC trainer plus Silver on three other tracks. PlayCISO issues a certificate only after checking your saved, server-scored shifts, and each certificate has a public page that lists those shifts as evidence. These are practice certificates, not accredited or proctored credentials. ## Frequently asked questions ### What is log triage? Log triage is reading a stream of security events, deciding which are normal and which point to an attack, and naming the detail that gives it away. It is the core daily task of a security operations analyst. ### Which environments can I practise? Enterprise SOC, Mobile (Android and iPhone), Kubernetes and cloud-native, Aircraft systems, Maritime and shipping, Hospital and medical devices, and Connected vehicles and EV charging. ### How do the certificates work? Bronze needs one graded shift. Silver needs three shifts averaging 70 or more, including an incident drill. Gold needs five shifts, a best score of 85 or more, every attack category fully solved, and a shift on the Analyst or Lead tier. The capstone needs Silver on the SOC trainer plus Silver on three other tracks. ### Are the logs real? No. Every log is generated from templates with fictional devices, people and organisations, modelled on the fields real tools record. ### Do I need an account? No account is needed to play. Sign in to save shifts to your journey and claim certificates.