SOC Case Triage Lab
A SIEM lab teaches you to read alerts. This teaches you to run the queue. You get 50 realistic security cases across four priorities, and for each one you make the three calls triage really turns on: how urgent is it, who should own it, and what is the first move. Route it wrong and it bounces back, just like the real thing.
Triage the queue
You are the SOC analyst on shift. For each case, set the priority, route it to the right team, and choose the first action. Pick the wrong team and the case bounces back to you. Score up to 4 points per case: 2 for priority, 1 for team, 1 for action.
What this lab is
- A free SOC triage lab: 50 realistic security cases across four priorities (P1 critical to P4 low) that you route like a real analyst.
- For each case you set the priority, assign the right team, and choose the first action — the three decisions triage actually turns on.
- Pick the wrong team and the case bounces back to you, the way a real queue works.
- You score 4 points per case: 2 for priority, 1 for team, 1 for action, with partial credit for being one band off.
- When you want to run a real queue, the paid Case Management system lets a team track live cases with full history.
Frequently asked questions
What is the Case Triage Lab?
A free, browser-based training game that puts you in the SOC analyst seat for 50 fictional security cases. For each one you decide the priority (P1 to P4), which team it should be assigned to, and the first action to take. You get immediate feedback and a rationale, and a running score. It is a triage drill, closer to a real case queue than a quiz.
How is a case scored?
Up to 4 points per case: 2 points for the exact priority (1 if you are one band off), 1 for routing it to the correct team, and 1 for the correct first action. If you assign it to a tempting but wrong team, the case "bounces back" and you see why — the same lesson a real mis-route teaches, faster.
Who is it for?
Aspiring and working SOC analysts, people prepping for a blue-team or SOC interview, and leaders who want to drill their team on consistent triage. No account or install needed.
Are these real incidents?
No. Every case is an invented training scenario modelled on the kinds of alerts a SOC sees — ransomware, business email compromise, account takeover, cloud exposure, insider risk and routine false positives. No real company, person or incident is depicted.
Run a real queue
When you are ready to track live cases, the Case Management system lets a team open, assign and resolve real cases with full history, priority and status — isolated to your team and retained for 30 days.
Open Case Management →