You can start creating the Threat Range event by clicking the Create New Event button on the top right side and choosing Threat Range

After filling out the simulation name, duration, and timezone, you’ll need to choose one of the available scenarios.
​

This will set up the event and allow players to join and choose their teams.Once the event is live, you can join as an Admin
​

Admins and Event Managers can customize the difficulty of a Threat Range event directly from the Content tab. Instead of using the default configuration, you can adjust Response SLA targets for alerts and tickets by severity (Low, Medium, High, and Critical) and configure the dispatch speed to control how quickly alerts and tickets are delivered to participants.

The default Alert SLA values are 120 minutes (Low), 60 minutes (Medium), 30 minutes (High), and 15 minutes (Critical). Ticket SLAs default to 240 minutes (Low), 120 minutes (Medium), 60 minutes (High), and 30 minutes (Critical). SLA values can be entered in minutes or hours.

Dispatch Speed can be set to Very Slow (×2.0), Normal (×1.0), Fast (×0.75), or Ultrafast (×0.5). Lower multipliers decrease the time between dispatched items, creating a more challenging event, while higher multipliers increase the interval for a more relaxed pace.

These settings allow you to tailor the pace and challenge of each event to match your audience's skill level, whether you're running a beginner workshop or an advanced SOC simulation. Changes apply only to newly dispatched items, and you can restore the default configuration at any time.

CertForge is a compromised small company following a public WingFTP foothold.

The incident response team faces a critical security challenge after alerts reveal signs of a coordinated intrusion across public-facing Linux services and the internal Windows domain.

They must quickly determine which events represent genuine attacker activity and which are expected administrator or deployment actions.

Difficulty: Medium

Cash Credentials simulates a real-world breach that begins when an insider threat sells valid VPN credentials on an underground marketplace.

Inspired by compromises attributed to the BlackSuit ransomware gang, this investigation challenges defenders to uncover subtle indicators of compromise, trace attacker activity across the environment, and respond before a ransomware deployment impacts the organization.

By completing this scenario, you will gain hands-on experience investigating credential access techniques, tracking attacker movement through Active Directory environments, identifying data theft activity, and responding to a ransomware attack from initial access through impact.

Difficulty: Hard

The Covenant simulation is a highly realistic Linux penetration testing scenario that mirrors a corporate network protected by a VPN.

The incident response team is facing a critical security challenge caused by a sudden surge in alerts. Your team must work together to uncover and eliminate a deeply hidden attacker foothold within the network.

The investigation focuses on tracing and documenting the attacker’s gradual expansion across the environment by analyzing logs, identifying compromised systems, and tracking lateral movement. The ultimate goal is to fully neutralize the threat before it leads to severe consequences such as data exfiltration, sabotage, or a complete operational shutdown.

Difficulty: Easy

ClickRAT simulates a real-world SOC investigation involving an Active Directory workstation compromise orchestrated by an Initial Access Broker (IAB).

After being lured to a convincing but malicious web portal, an MIRAI HR employee unknowingly triggers a silent compromise on their workstation.

As the team responsible for defending the organization, you must investigate the attacker’s foothold, track their movement throughout the environment, and stop the attack before it escalates further.

Difficulty: Medium

Act as a SOC team working for ForelaSec to defend a customer against a short but fast-moving attack.

You work for ForelaSec, a newly established MSSP providing SOC and DFIR services to customers worldwide.

The week has been relatively quiet, with only routine phishing alerts and false positives keeping the team occupied — until now. A rapid attack begins unfolding, and your team must quickly respond, investigate, and contain the threat before significant damage occurs.

Difficulty: Easy

One of your staff members has fallen victim to a targeted spearphishing campaign designed to compromise your environment.

As part of the security team responsible for monitoring and defending the network, you must work together to quickly identify the attacker’s path as they move through the domain and expand their access.

Difficulty: Medium

Your team is responsible for defending an Active Directory environment under active attack, where multiple systems are showing signs of an escalating ransomware campaign.

The initial point of compromise is not immediately clear. Indicators are scattered across SMB activity, PowerShell execution, authentication events, and endpoint logs. Your task is to piece together the evidence, uncover the full attack chain, and stop the ransomware operation before it spreads further.

Difficulty: Medium

Your team has been assigned to monitor and defend a network where several systems are beginning to exhibit suspicious activity.

As signs of compromise continue to emerge, your team must investigate the affected systems, identify the attacker’s movements, and contain the threat before it escalates into a larger security incident.

Difficulty: Medium

Once the Event starts and you join as Administrator, you can see the Dashboard

The Administrator Dashboard provides a centralized overview of the event, allowing administrators to monitor team activity, track investigations, and review overall event performance in real time.
​

Displays the current members assigned to the SOC L1/L2 and Digital Forensics teams, along with quick access links to relevant guides and resources.

SOC L1/L2 analysts are responsible for monitoring incoming alerts, performing initial investigations, and determining the severity and impact of suspicious activity. Their role focuses on triaging events, gathering evidence, documenting findings, and escalating incidents that require deeper forensic investigation.
​

Digital Forensics (L3) analysts handle escalated tickets that require advanced investigation. Using SIEM data, forensic tooling, and endpoint access, they validate escalations, analyze attacker activity, trace the full attack path, and determine the root cause and impact of incidents. They are also responsible for identifying incorrect escalations and documenting their findings thoroughly.

Shows the average time taken to respond to and resolve alerts, including the full process from initial detection to final resolution.

Provides a summary of all alerts generated during the event, including:

Measures the effectiveness of the teams in detecting, responding to, and recovering from attacks during the event.

This section includes:

Displays the ranking order of participants throughout the event.

Shows the remaining time before the event ends.

Administrators have read-only access to the Alerts and Tickets pages.

Admins can:

This access allows administrators to oversee investigations without modifying active tasks or responses.

The Analytics Tab is only accessible after the scenario ends. It shows different metrics and statistics that help the Administrators analyse their team's performance.
​

Once the team uploads an Incident report, you can check it by clicking the download button on the Analytics page here: