Can You Investigate an Incident You Haven't Seen Before?
That's the test that matters. Not whether you can follow a walkthrough — whether you can scope, investigate, and contain when you don't know the answer yet. These scenarios give you an incident brief, sample data, and investigation questions. You work through it independently. Then you check your reasoning against a detailed solution walkthrough.
M365 Investigation Scenarios
After these challenges, you've investigated a consent phishing campaign across four users, conducted a covert insider threat investigation without tipping off the subject, and traced a BEC attack from initial sign-in to mailbox forwarding rule. These are the incidents you'll see at work — now you've already worked them.
SOC Investigation Scenarios
After these challenges, you've traced an AiTM token replay across multiple accounts under time pressure, and contained a ransomware event before encryption completed. The scenarios where your SOC playbooks either work or they don't — tested here instead of at 2AM on a Tuesday.
AI-Assisted Investigation Scenarios
After these challenges, you've used AI to trace a BEC campaign and produce a court-defensible IR report in hours instead of days, and built three detection rules from a post-incident review that closes the gaps the attacker exploited. AI as an accelerator for work you already know how to do — tested against scenarios where bad AI judgment would make things worse.
The next incident won't come with a walkthrough.
These challenges build the muscle memory so that when the real alert fires, you've already worked something similar. Start with the course to learn the methodology, then prove you own it here.