Threat Range is a collaborative blue team simulation where players work together to detect, investigate, and respond to active cyber attacks in a live environment.

Participants are assigned different roles across SOC and Digital Forensics teams, each with their own responsibilities during the exercise. Success depends on communication, investigation quality, and how effectively the teams work together under pressure.

To participate in a Threat Range event, you must first join your organisation on the CTF platform, and then you can check the upcoming events and find the Threat Range. Once you enter the event, you can choose one of the roles:

​
Your assigned role determines the tools, pages, and responsibilities available to you during the simulation.

As a SOC analyst, your primary responsibility is to monitor incoming alerts, investigate suspicious activity, and determine whether incidents should be escalated.

You will:

Your goal is to quickly identify real threats while minimizing unnecessary escalations.

As a Digital Forensics analyst, your role begins when a ticket is escalated to your backlog.

Using SIEM data, DFIR tooling, and endpoint access, you will:

Your investigations help uncover the complete attack path and improve the team’s overall response effectiveness.

Threat Range is designed around teamwork between the SOC and Digital Forensics teams.

SOC analysts are responsible for identifying and escalating suspicious activity, while Digital Forensics continue the investigation and validate escalation decisions.

Clear communication and detailed handovers are critical to success. Strong collaboration allows teams to respond faster, reduce missed threats, and improve overall resilience during the event.

Throughout the exercise, alerts will continuously appear as attacker activity unfolds within the environment.

Alerts represent suspicious or potentially malicious activity detected within the environment.

SOC analysts are responsible for:

Alerts may vary in severity and complexity depending on the scenario.

You can assign alerts to yourself or other L1/L2 players using the button on the right side of each alert:

Once assigned you can open the alert and start triaging,

You will be tasked with filling notes, selecting TP/FP, and the impact.
Escalation is required for Medium, High, and Critical in case of True Positive.
​

Once you close the Alert you will see the scorecard for it, If escalated, scoring is delayed until the associated ticket is resolved by Digital Forensics.

Tickets are created when incidents require additional investigation by the Digital Forensics team.

Tickets contain:

As a Digital Forensics you can assign tickets to yourself from the backlog using the rightmost button and choosing your username:

Once a ticket is assigned, you can start investigating by following the notes and information left by the SOC L1/L2 players:

You will be tasked to answer all the questions based on your findings and decide whether the escalated alert warrants further action. If confirmed, provide supporting evidence and close the ticket with your analysis. If not, save time by de-escalating the ticket.

Once you take the decision and submit it you will see your Ticket score, more on scoring in the next section.

The Network Discovery page provides centralized access to the infrastructure used throughout the simulation. It allows players to view hosts involved in the exercise, access investigation tooling, and perform endpoint or log-based analysis during ticket investigations.

The page also includes options to reset the range if issues occur during the simulation.

Access to hosts and tooling depends on the player’s assigned role:

​
Each host contains:

DFIR Instance

Each host includes a dedicated DFIR Instance button that opens an environment instrumented with endpoint telemetry and investigation tooling.

SSH Access

Direct SSH access is available with the provided usernames and passwords.

SIEM Access

Analysts can connect to the SIEM to review correlated alerts and raw logs from across the environment.

Each investigation contributes to your team’s overall performance during the event.

Scoring is based on factors such as:

Efficient handling of incidents improves the team’s Threat Resilience Index and overall ranking within the event.

The Threat Resilience Index measures how effectively your team responds to attacks during the simulation.

The score reflects:

Teams that respond quickly and accurately will maintain a stronger resilience rating throughout the event.

At the end of the simulation, teams are required to submit an Incident Report summarizing their investigation and overall understanding of the attack.

The Incident Report represents the final deliverable of the exercise and simulates the type of reporting produced by real-world SOC and Digital Forensics teams after an incident.

Any team member can submit the Incident Report. While the report is commonly led by Digital Forensics or L3 analysts, collaboration between all team members is strongly encouraged

Submitted reports are made available to administrators through the Analytics page for review and evaluation..