Enterprise Threat Investigation Range

Master SOC Analysis Across
Splunk Enterprise & Microsoft Sentinel

Real-world attack simulations replicating high-severity cyber attacks. Investigate Active Directory intrusions, Kerberoasting, privilege escalation, and lateral movement side-by-side using SPL and KQL.

GitHub Repository

Student Progress 150 / 500 XP

1 / 4

Labs Solved

Tier 1

Analyst Rank

Company accounts auto-sync with your Cybertection student profile.

Active SOC Investigation Scenarios

Complete challenges in both Splunk and Sentinel to earn verified SOC analyst badges.

Tier 1 Analyst 100 XP

AD Security Auditing & Brute Force

Detect unauthorized user creation (`4720`), rogue group elevation (`4728`), and distributed password spray attacks (`4625`) against domain controllers.

EventCode 4625 T1110.003 Splunk + Sentinel

Tier 2 Analyst 150 XP

Kerberoasting & Lateral Movement

Investigate abnormal TGS ticket requests (`4769`) with RC4 ticket encryption, correlate Sysmon network sessions (Event 3), and map lateral traversal.

EventCode 4769 T1558.003 T1021

Threat Hunter 250 XP

Automated SOAR Incident Response

Connect Splunk SOAR / Sentinel Logic Apps to isolate infected endpoints, disable compromised domain accounts, and generate forensic case tickets.

SOAR Playbooks Logic Apps Auto Containment

Unlocks after Scenario 2

Automated Scoring & Grading Engine

Submit Incident Findings & IOCs

Enter the compromised indicators extracted from your Splunk SPL or Sentinel KQL queries to earn credits.

Backend Status: Online (Firebase Sync)

TRACK 01: SPLUNK ENTERPRISE & CLOUD

Splunk Search Processing Language (SPL) Lab

Directly connect to your assigned corporate Splunk instance or local forwarder. Practice index management, query optimization, and threat hunting.

Launch Local Splunk Web (8000) Open Splunk Cloud Instance

Enterprise Splunk Connection

Assigned

Splunk Host: cyberjoe009.splunkcloud.com:8089

Index Name: wineventlog

Assigned Role: soc_analyst_tier1

Active Forwarders: DC01, WS01, WS04

Essential SPL Hunting Queries

Detect Kerberoasting Ticket Requests (4769)

index=wineventlog EventCode=4769 Ticket_Encryption_Type=0x17 | stats count by src_ip, TargetUserName, Service_Name | where count > 5

Correlate Password Spraying Across Endpoints (4625)

index=wineventlog EventCode=4625 | stats dc(TargetUserName) as targeted_users count by src_ip | where targeted_users > 3

Student Lab Walkthrough: Lateral Movement & PrivEsc

Scenario Briefing: The SIEM triggered an alert indicating that a compromised workstation account (WS04$) has been querying multiple Kerberos Service Principal Names (SPNs) with weak RC4 encryption.

Log into your assigned Splunk interface and navigate to Search & Reporting.
Run query: index=wineventlog EventCode=4769 service_name="*" | stats count by src_ip, TargetUserName, service_name | where count > 10 | sort - count
Identify the Service Account being targeted for offline cracking.
Submit the Service Account in the Automated Scoring Engine on the SOC Range tab.

TRACK 02: MICROSOFT SENTINEL & AZURE SOC

Microsoft Sentinel Kusto Query Language (KQL) Lab

Access your corporate Azure Sentinel workspace. Learn Log Analytics table structures, KQL syntax, custom Analytic Rules, and investigate threats using the Sentinel Incident Graph.

Open Company Azure Sentinel Portal Microsoft Sentinel Documentation

Company Sentinel Workspace

Connected

Workspace Name: Cybertection-SOC-Workspace

Subscription: Cybertection Enterprise Training

Table Targeted: SecurityEvent

Data Connector: Windows Security via AMA

Authenticate to Azure Tenant

Sentinel Scheduled Analytic Rule

Deploy this KQL rule in Sentinel to generate High-severity alerts when abnormal Kerberoasting tickets are requested:

SecurityEvent
| where TimeGenerated > ago(1h)
| where EventID == 4769 and TicketEncryptionType == "0x17"
| where ServiceName !endswith "$"
| summarize TicketCount = count(), Services = make_set(ServiceName) 
    by TargetAccount, IpAddress
| where TicketCount > 5

Sentinel Incident Investigation & Graph Exploration

In Microsoft Sentinel, alerts automatically correlate into Incidents. Analysts use the Investigation Graph to visually explore links between compromised accounts, IP addresses, and virtual machines.

1. Triage Incident

Review Severity, Owner, and MITRE ATT&CK tactic tags.

2. Entity Mapping

Examine User Accounts, Hostnames, and External IP entities.

3. Playbook / SOAR

Trigger an Azure Logic App to isolate the VM or reset passwords.

One Unified Cybersecurity Platform

The Cybertection Training Center Ecosystem

Every platform, laboratory environment, AI agent, and resource from our master directory — connected in one central portal for students and cybersecurity professionals.