Skip to content
Free lab · no signup · Aircraft log triage

Aircraft Systems Log Triage

You are on shift in the security operations team of PlayAir, a fictional airline. Logs arrive from the systems around the aircraft: cabin Wi-Fi and IFE, crew tablets, maintenance laptops, data loaders, ACARS and the ops center. Most are routine; find the ones that break the rules that keep the aircraft domains separate and its software trustworthy.

Tiers
Trainee · Analyst · Lead
Logs per shift
400–1000
Attack types
6
Mapped to
MITRE ATT&CK for ICS

Your journey → certificate

BronzeSilverGold

Loading your progress…

All log triage tracks and the capstone · practice certificates, not accredited credentials.

1 in 5 logs hides an attack. 400 logs in the practice set.
10 logs ≈ 3 minutes → a graded shift scorecard you can share.

How to play: a 20-second start

  1. Pick a log in the inbox. Most are normal operations; a few are attacks.
  2. In the detail pane, click any field value that looks wrong.
  3. Hit Check: green = a real flag caught, amber = a flag missed, red = false alarm, each with a “why”.
  4. Stuck? Press Reveal to learn the answer (not scored). Use End shift for your report.
0Reviewedof 400
0Signals caught
0Missed
0False alarms
0%Recallof red flags
0Streak
0/10 logs to your shift scorecard
Inbox400 logs
Cabin Wi-Fi / IFEinfoL100175 · 23:57:07 UTC

Flight-info feed to IFE moving map on ZX-B07

ZX-B07

Click any field value you think is a red flag (or press 1–9), then Check.

0/10 logs to your shift scorecard

How scoring works

Your shift score (0–100) is 60% red-flag recall (the suspicious fields you caught) plus 40% flag precision (how many of your flags were real). Only logs you check without pressing Reveal count. Check 10 logs, at least one of them an attack, and you get a graded scorecard with a share link. The score is recomputed on the server from the same deterministic log set, so a saved card always matches what you flagged. The daily shift is the same set for everyone that UTC day. Every log is synthetic: no real devices, people or networks.

Attack types in this track

Loadable software & supply chain

A software part that is unsigned, does not match its manifest, came from the wrong place or is loaded without a work order.

  1. Stop the load and quarantine the file and the loader.
  2. Compare the part against the OEM manifest and the software library.
  3. Ground the aircraft from further loads until maintenance control signs off.

Cabin-to-aircraft domain crossing

Traffic from the passenger or IFE side trying to reach networks it should never see, usually stopped at the domain gateway.

  1. Confirm the gateway denied every attempt and keep its logs.
  2. Isolate the source IFE host or passenger session.
  3. Ask the IFE vendor to image the host before it is rebooted.

Datalink & navigation spoofing

Messages or position data that do not fit the aircraft's known state, arrive through unknown stations, or cluster in one area.

  1. Tell the affected crews and have them verify by voice.
  2. Cross-check against surveillance and dispatch records.
  3. Report to the regulator and the datalink service provider.

Vendor & remote access

Remote sessions out of hours, without a ticket or recording, or exploit traffic against remote-access appliances.

  1. End the session and disable the account or appliance access.
  2. Call the vendor on a known number to confirm whether it was them.
  3. Review what the session touched and patch the exposed device.

Crew & maintenance device hygiene

Tablets or laptops that are jailbroken, out of date, running unapproved apps or using unscanned media near the aircraft.

  1. Pull the device from service and issue a spare.
  2. Check what it connected to while non-compliant.
  3. Re-image it and confirm posture before it returns.

Credential & account abuse

Default passwords, shared admin accounts or valid accounts used from odd places for bulk access.

  1. Reset the credential and end active sessions.
  2. Check what was accessed or exported.
  3. Replace shared or default accounts with named ones and MFA.

FAQ

Is this lab about hacking aircraft?

No. It covers the systems around an aircraft that airline and airport security teams actually monitor: crew tablets, maintenance laptops, software loading, cabin Wi-Fi, datalink and vendor access. It teaches how to spot red flags, not how to attack anything.

What are aircraft network domains?

Aircraft networks are split into domains, commonly the aircraft control domain, the airline information domain and the passenger domain. Data is allowed to flow from the more trusted domains out to the cabin, never the other way. Traffic trying to cross back in is a key thing to watch.

What is an EFB?

An electronic flight bag is the tablet pilots use for charts, manuals and performance calculations. Because crews rely on it, operators control which apps are allowed and keep the tablets under device management.

Why do loadable software parts need signatures?

Aircraft software is delivered as parts that engineers load with a data loader. A manufacturer signature and a matching manifest prove the part is the one that was approved. An unsigned or changed part is a possible supply-chain compromise.

What is GNSS interference and why does ops care?

GNSS interference is jamming or spoofing of satellite navigation signals. Several aircraft reporting position jumps in one area, with no published test, suggests interference. Ops warns crews and plans routes that do not depend on GNSS.

Why MITRE ATT&CK for ICS?

Aviation operations run on specialised industrial-style systems, and the ICS matrix describes techniques such as supply-chain compromise, program download and remote services that map well to this environment.

More security tools

The tools people use most on PlayCISO.

All tools
Prompt Scan

Catch injected instructions hiding in content your AI agent should only read.

ISO/IEC 27090 Readiness

Score your readiness against the first international standard for AI security threats.

CVE Trends

Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.

Firewall Lab

Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.

NIST CSF 2.0 Assessment

Self-assess all six Functions, from Govern to Recover, and see your weakest one.

APT Naming Rosetta Stone

Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.

🖤 Black Friday: new customers get 3 months of Pro for $5, then $5/month. Ends 30 Nov. See the deal