Skip to content
Free lab · no signup · Hospital log triage

Hospital & Medical Device Log Triage

You are on shift in the security operations centre of a fictional hospital. The stream mixes EHR access, imaging (DICOM), HL7 feeds, infusion pumps, medical IoT, badges and vendor sessions. Most of it is normal clinical noise; flag the logs that hide an attack and say which fields give it away.

Tiers
Trainee · Analyst · Lead
Logs per shift
400–1000
Attack types
7
Mapped to
MITRE ATT&CK Enterprise

Your journey → certificate

BronzeSilverGold

Loading your progress…

All log triage tracks and the capstone · practice certificates, not accredited credentials.

1 in 5 logs hides an attack. 400 logs in the practice set.
10 logs ≈ 3 minutes → a graded shift scorecard you can share.

How to play: a 20-second start

  1. Pick a log in the inbox. Most are normal operations; a few are attacks.
  2. In the detail pane, click any field value that looks wrong.
  3. Hit Check: green = a real flag caught, amber = a flag missed, red = false alarm, each with a “why”.
  4. Stuck? Press Reveal to learn the answer (not scored). Use End shift for your report.
0Reviewedof 400
0Signals caught
0Missed
0False alarms
0%Recallof red flags
0Streak
0/10 logs to your shift scorecard
Inbox400 logs
Medical IoT GatewaylowL100342 · 23:56:54 UTC

Asset scan: IMG-WS-03 legacy OS (segmented)

IMG-WS-03

Click any field value you think is a red flag (or press 1–9), then Check.

0/10 logs to your shift scorecard

How scoring works

Your shift score (0–100) is 60% red-flag recall (the suspicious fields you caught) plus 40% flag precision (how many of your flags were real). Only logs you check without pressing Reveal count. Check 10 logs, at least one of them an attack, and you get a graded scorecard with a share link. The score is recomputed on the server from the same deterministic log set, so a saved card always matches what you flagged. The daily shift is the same set for everyone that UTC day. Every log is synthetic: no real devices, people or networks.

Attack types in this track

Inappropriate Record Access

EHR access with no care relationship: break-the-glass on restricted records, or one account opening hundreds of charts.

  1. Preserve the EHR access audit trail for the user and the patients touched.
  2. Suspend or restrict the account and interview the user with their manager and privacy office.
  3. Assess whether this is a reportable privacy breach and start the notification clock.

Clinical Data Exfiltration

PHI leaving by clinical protocols: DICOM moves to unknown AE titles or HL7 feeds to destinations not in the interface catalog.

  1. Block the external destination at the firewall and disable the channel or AE entry.
  2. Work out exactly which studies or messages left, and when the route was created.
  3. Find who created it and check that account for wider compromise.

Device & Clinical Data Tampering

Unapproved changes that alter care: drug library limits raised, default device accounts used, or lab values rewritten in transit.

  1. Involve clinical engineering and pharmacy immediately and roll back to the last approved library or rule.
  2. Check which pumps or results were affected and alert the units that use them.
  3. Lock down the admin path used (default account, source workstation) and preserve logs.

Exposed Legacy Devices

Unsupported OSes and plaintext admin services reachable from the corporate network or the internet.

  1. Restrict the device to its clinical VLAN with an ACL, without interrupting patient care.
  2. Look for signs it has already been accessed or exploited.
  3. Agree a patch, compensating-control or replacement plan with the device vendor.

Vendor Remote Access Abuse

Vendor sessions at odd hours, without tickets, from unexpected countries, or moving large files.

  1. Terminate the session and disable the vendor account.
  2. Call the vendor on a known number to confirm whether it was them.
  3. Review what was done on the target and move vendor access to per-session approval.

Ransomware Precursor

Shadow-copy deletion, PsExec fan-out from a clinical workstation, and mass file renames on clinical shares.

  1. Isolate the affected workstation(s) from the network now.
  2. Activate downtime procedures so clinical care continues on paper.
  3. Disable the account used and hunt for the same activity on other hosts.

Phishing & Account Takeover

Look-alike EHR emails, MFA push spam and sign-ins that disagree with the badge system.

  1. Reset the password and revoke sessions and MFA registrations for the user.
  2. Check what the account accessed in the EHR since the suspicious sign-in.
  3. Pull the phishing email from every mailbox and block the sender and link.

FAQ

Is any of this real patient data?

No. The hospital, staff, vendors, patients and MRN-style numbers are all invented. Every log is generated in your browser from a fixed seed for training only.

Why is break-the-glass sometimes normal?

Break-the-glass exists so clinicians can reach records in an emergency. It is expected from an ED clinician with an open encounter and a clinical reason. It is suspicious from a non-clinical user, with no care relationship, on a restricted record.

Why does an old operating system not always mean an incident?

Many imaging and lab devices run vendor-locked, older systems. The risk depends on exposure: segmented, with documented compensating controls, it is managed risk. Reachable from the corporate network with SMBv1 on, it is an incident waiting to happen.

Which MITRE framework does this lab use?

MITRE ATT&CK Enterprise. Hospital IT and most connected medical devices run on enterprise operating systems and protocols, so Enterprise techniques such as Valid Accounts, Exfiltration Over Alternative Protocol and Data Manipulation fit best.

What should I do first in a real hospital incident?

Protect patient safety first: involve clinical engineering and switch to downtime procedures where needed, then contain. Never power off or isolate a device that is keeping a patient alive without clinical sign-off.

More security tools

The tools people use most on PlayCISO.

All tools
Prompt Scan

Catch injected instructions hiding in content your AI agent should only read.

ISO/IEC 27090 Readiness

Score your readiness against the first international standard for AI security threats.

CVE Trends

Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.

Firewall Lab

Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.

NIST CSF 2.0 Assessment

Self-assess all six Functions, from Govern to Recover, and see your weakest one.

APT Naming Rosetta Stone

Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.

🖤 Black Friday: new customers get 3 months of Pro for $5, then $5/month. Ends 30 Nov. See the deal