Analyst Defense Labs.
Continuous, hands-on skills development and investigation labs for SOC analysts and defenders who want to sharpen real-world skills — not chase points on a leaderboard.
New labs added regularly · Cancel anytime
What’s Inside
Each lab is a self-contained investigation or skill module you can complete at your own pace.
Investigation scenarios
Work through realistic compromise cases — BEC, server breaches, network intrusions — analyzing real artifacts in guided, in-browser environments.
Detection & analysis labs
Build practical skills in Sigma rules, YARA detection, Splunk analysis, threat intelligence, and phishing investigation using industry tools.
Growing library
New labs added regularly covering emerging threats, new tools, and expanding investigation domains. Your subscription gets more valuable over time.
Who It’s For
Lab Library
All labs included with your subscription. New labs added regularly.
Detection Engineering with Sigma
Learn how to design, validate, and operationalize Sigma detections—from single-event rules to correlation-based attack detection—using real SOC workflows.
Malware Detection with YARA
Malware Identification with YARA is a hands-on course that teaches analysts how to write effective YARA rules to detect, classify, and hunt malware across disk and memory using real-world samples and investigation-driven labs.
Foundations of Cyber Threat Intelligence
This course introduces the core concepts, frameworks, and analytical practices of Cyber Threat Intelligence.
React2Shell Server Compromise Investigation
A guided, real-world investigation of a React web application compromise that teaches analysts how to perform high-fidelity network (PCAP) and Linux server forensics using advanced, command-line–driven investigative techniques.
Microsoft 365 BEC Investigation
Investigate Business Email Compromise (BEC) using Microsoft 365 unified audit log telemetry.
Splunk BOTS v3
A hands-on Splunk investigation course that builds real-world SOC analysis skills by analyzing a realistic enterprise dataset to identify, scope, and correlate multiple concurrent security incidents using SPL and SIEM methodology.
BEC Investigation with SOF-ELK
This course builds on Microsoft 365 UAL fundamentals by introducing SOF-ELK as a scalable investigation platform for analyzing audit log data and identifying Business Email Compromise activity.
Phishing Email Detection with Sublime
Email threat detection and phishing analysis using the Sublime Security platform, progressing from email fundamentals through hands-on detection engineering.
Really enjoying the Analyst Defense Labs. This one teaches you how to correlate Microsoft Entra ID with Exchange logs — specifically the ExchangeAdmin and AzureActiveDirectoryStsLogon records. Looking forward to doing even more labs from this path.
Adrian Iuliano
DFIR Engineer · PSAP · CSIL-CCFI
Choose Your Plan
Full access to every lab from day one. Cancel anytime.
Want the complete training path? ADL is included free for 12 months with the Hero Bundle →
Training a team? The Hero Bundle for Teams includes volume discounts, a team lead dashboard, and centralized progress tracking. Learn more →
How It Works
Subscribe
Pick monthly or annual. Instant access to every lab.
Pick a Lab
Choose an investigation scenario or skill lab. Start in your browser.
Investigate
Analyze real artifacts, follow the evidence, and build the skills that matter on the job.
Frequently Asked Questions
What do I get with my subscription?
Is this different from the training tracks?
Do I need to complete a training track first?
Can I cancel anytime?
Is ADL included with the Hero Bundle?
What tools or software do I need?
How often are new labs added?
Ready to Start Investigating?
Full access to every lab. New scenarios added regularly. Cancel anytime.
Or get ADL free for 12 months with the Hero Bundle