Log triage labs
Learn to read security logs in every environment
Each track drops you into a shift of synthetic logs from one kind of environment. Most events are normal; a few hide an attack. Click the exact fields that give it away, get a graded scorecard, and work from Bronze to Gold for a certificate anyone can verify.
Your journey
Loading your journey…
Tracks
🛡️ SOC Log Triage
Identity, endpoint, cloud, email and network logs in an enterprise SOC.
📱 Mobile Log Triage (Android & iPhone)
Sort sideloaded apps, rogue profiles and OTP theft from a fleet of Android and iPhone logs.
☸️ Kubernetes & Cloud-Native Log Triage
Spot privileged pods, stolen service-account tokens and miners in a stream of cluster logs.
✈️ Aircraft Systems Log Triage
Triage an airline shift: data loaders, EFBs, cabin Wi-Fi, ACARS and vendor access.
🚢 Maritime & Shipping Log Triage
Triage a fleet watch: GNSS, AIS, ECDIS, VSAT, engine and ballast control, ports.
🏥 Hospital & Medical Device Log Triage
Spot record snooping, PHI exfiltration and device tampering in a synthetic hospital log stream.
🚗 Connected Vehicle & EV Charging Log Triage
Catch rogue OTA updates, CAN injection, app API abuse and charger takeovers in synthetic fleet telemetry.
How the levels work
- Bronze: complete one graded shift.
- Silver: three shifts, an average score of 70 or more, and one incident drill.
- Gold: five shifts, a best score of 85 or more, every attack category fully solved, and at least one shift on a harder tier.
- Capstone, Multi-Domain Log Analyst: Silver on the SOC trainer plus Silver on three other tracks.
Questions
What is log triage?
Log triage is reading a stream of security events, deciding which ones are normal and which ones point to an attack, and naming the exact detail that gives it away. It is the core daily task of a security operations (SOC) analyst.
Are these logs real?
No. Every log is generated from templates, with fictional devices, users and organisations, so you can practise safely. They are modelled on the fields real tools record.
How do the certificates work?
Each track has three levels. Bronze needs one graded shift, Silver three shifts averaging 70 or more including an incident drill, and Gold five shifts with a best of 85 or more, every attack category solved and a harder tier. PlayCISO checks your saved, server-scored shifts before it issues a certificate, and each certificate has a public page listing that evidence.
Do I need an account?
No account is needed to play. Sign in to save shifts to your journey and claim certificates.
Is this an accredited certification?
No. These are practice certificates for training exercises, not accredited or proctored credentials.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.