Browse everything
Roadmaps, courses and hands-on labs — search or filter. All roadmaps · Lab catalogue
Filters 1
Filter results
Type
- Hands-on lab 199
Topic
- Azure 425
- Cyber Security Labs 283
- ✓ Blue Team 199
- Essential IT 186
- General Cyber security 157
- Programming 141
- AWS 113
- Data Science 101
- Networking 92
- VMware 80
- Advanced General Cyber Security 47
- Linux 46
- Hacking 43
- Web hacking 27
- Google Cloud 9
- Artificial Intelligence 3
Included in
Topic: Blue TeamClear all
199 results — showing 1–100
Hands-on labStationX Membership
Auditing Service Accounts and Setting Up Automated Log CollectionCritical Security Controls + 2 more blocksDuration: 2 hStudents will explore information-gathering techniques, audit service accounts in a Windows Environment, collect Windows logs, and automate log transfer with Syslog.
Hands-on labStationX Membership
BitLocker SetupCritical Security ControlsDuration: 1 hThis lab shows the student how to setup BitLocker on a Windows 8.1 Professional system.
Hands-on labStationX Membership
Centralized MonitoringCritical Security Controls + 1 more blockDuration: 1 hIn this lab, students will learn how to ingest log data into Splunk by first manually uploading log files for analysis.Hands-on labStationX Membership
CIRP Creation and DisasterCritical Security ControlsDuration: 2 hStudents will become familiar with the creation of a Cyber Incident Response Plan (CIRP).Hands-on labStationX Membership
Comparing ControlsCritical Security ControlsDuration: 1 hStudents will evaluate policies in place on a domain and apply those policies in accordance to organizational standards.
Hands-on labStationX Membership
Creation of Standard Operating Procedures for RecoveryCritical Security ControlsDuration: 1 hStudents will have access to the results of a vulnerability scan run again a sample Windows 2008 Server.Hands-on labStationX Membership
Data Backup to Prep for RecoveryCritical Security Controls + 3 more blocksDuration: 1 hIn this lab we will simulate the recovery phase where we must perform a backup in a server environment.Hands-on labStationX Membership
Data Downloads and ValidationCritical Security ControlsDuration: 1 hIn this lab, students will learn to validate downloads to mitigate risk.Hands-on labStationX Membership
Force Point: DLP Email OverviewCritical Security ControlsDuration: 1 hForcepoint DLP will teach the student how to configure Forcepoint DLP to stop data loss on the email channel.Hands-on labStationX Membership
Force Point: DLP Network OverviewCritical Security ControlsDuration: 1 hDLP network: Monitors and enforces DLP policies across several communication channels, including email, web, IM, network printing.Hands-on labStationX Membership
Identifying Key AssetsCritical Security ControlsDuration: 1 hStudents will use nmap to identify specific assets on their network.Hands-on labStationX Membership
Leveraging Internal Intelligence ResourcesCritical Security ControlsDuration: 1 hStudents will leverage Zenmap and Tenable Nessus vulnerability scanner in order to perform an internal scan of networked resources.Hands-on labStationX Membership
Log Correlation & Analysis to Identify Potential IOCCritical Security ControlsDuration: 1 hWhen defending networked digital systems, attention must be paid to the logging mechanisms set in place to detect suspicious behavior.Hands-on labStationX Membership
Monitoring and Verifying Management SystemsCritical Security Controls + 1 more blockDuration: 1 hIn this lab, students will use Nessus Essentials to assess a system for vulnerabilities and generate a detailed analysis report.Hands-on labStationX Membership
Open and Close Ports on Windows 7Critical Security ControlsDuration: 1 hIn this lab, the student will kill some processes and close down some shares in response to a suspected threat.Hands-on labStationX Membership
Phishing (2026)Critical Security ControlsDuration: 1 hIn this hands-on lab, students will explore the fundamentals of phishing attacks and user awareness by using the Social-Engineer Toolkit (SET) to create a phishing email and simulate a real-world…Hands-on labStationX Membership
PhishingCritical Security Controls + 1 more blockDuration: 1 hStudents will send a phishing email using the Social Engineering Toolkit.Hands-on labStationX Membership
Post Incident Service RestorationCritical Security ControlsDuration: 1 hIn this lab, students will focus on the recovery phase of incident response by restoring critical services on a compromised host in a post-incident environment.Hands-on labStationX Membership
RansomwareCritical Security ControlsDuration: 1 hStudents will learn what ransomware is, observe how it works, and implement mitigation strategies to recover from a ransomware attack.Hands-on labStationX Membership
Recover from SQL Injection AttackCritical Security ControlsDuration: 1 hAfter identifying a SQL Injection attack, students will learn about parameterized queries in back-end web servers to minimize future SQLi attacks.Hands-on labStationX Membership
Sensitive Information IdentificationCritical Security ControlsDuration: 1 hStudents will utilize Data Loss Prevention (DLP) software to identify documents potentially containing sensitive information.
Hands-on labStationX Membership
Vulnerability Identification and RemediationCritical Security ControlsDuration: 1 hLearners will use Nmap and OpenVAS/Greenbone Vulnerability Scanner to confirm old vulnerable systems and to also discover new ones.
Hands-on labStationX Membership
Analyze and Update a Company BCP/BIA/DRP/CIRPCyber Defense Incident Responder + 2 more blocksDuration: 2 hStudents will become familiar with the Business Continuity Plan (BCP), Business Impact Assessment (BIA), Disaster Recovery Plan (DRP) and Computer Incident Response Plan (CIRP).
Hands-on labStationX Membership
Analyze SQL Injection AttackCyber Defense Incident Responder + 1 more blockDuration: 1 hStudents will Identify the use of an SQL Injection through the use of Wireshark.
Hands-on labStationX Membership
Analyze Various Data Sources to Confirm Suspected InfectionThreat Intelligence & DefenseDuration: 1 hStudents will review network traffic to confirm the presence of malicious activity using various tools including Wireshark and VirusTotal.com.
Hands-on labStationX Membership
Applying Filters to TCPDump and WiresharkCyber Defense Incident ResponderDuration: 1 hThis lab exercise is designed to allow the trainee to become familiar with applying a capture filter to TCPDump and Wireshark using Berkley Packet Filter (BPF) syntax.Hands-on labStationX Membership
Assessing Vulnerabilities Post AddressalThreat Intelligence & DefenseDuration: 1 hStudents will use Snorby against multiple systems to identify and mitigate any vulnerabilities found.Hands-on labStationX Membership
BitCoin Mining Web Application on Corporate NetworkThreat Intelligence & DefenseDuration: 1 hStudents will identify unauthorized activity on a corporate network.Hands-on labStationX Membership
Block Incoming Traffic on Known PortCyber Defense Incident ResponderDuration: 1 hIn this lab, the student will respond to an incident by blocking incoming traffic on a known port from a specific IP.
Hands-on labStationX Infrastructure Labs
Can You Examine Network Communications by Using Incident Response Tools?Cyber Security Incident ResponseLevel: AdvancedDuration: 45 minIn this lab, you will examine network communications by using incident response tools.Hands-on labStationX Infrastructure Labs
Can You Manage Logs with Scripts, Perform File Restoration, and Perform Vulnerability Scans?Cyber Security Incident ResponseLevel: AdvancedDuration: 45 minIn this lab, you will manage logs with scripts, perform file restoration, and perform vulnerability scans.Hands-on labStationX Infrastructure Labs
Can You Perform File Restoration, Manage GPOs, and Perform OSINT?Cyber Security Incident ResponseLevel: ExpertDuration: 1 hIn this lab, First, you will prepare for backup operations, and then you will configure Windows File History and perform a backup.Hands-on labStationX Infrastructure Labs
Can You Use GPOs and Security Templates as Part of IR?Cyber Security Incident ResponseLevel: AdvancedDuration: 1 hIn this lab, you will use GPOs and security templates as part of IR.Hands-on labStationX Membership
Check for Indicators of Other Attack Activity (Debug PE File)Threat Intelligence & DefenseDuration: 2 hStudents will check for indications of other attack activity.Hands-on labStationX Membership
Comprehensive Threat ResponseCyber Defense Incident Responder + 2 more blocksDuration: 2 hIn this final lab, we will attempt to exercise all the relevant skills found in this domain.
Hands-on labStationX Membership
Conduct Log Analysis and Cross Examination for False PositivesVulnerability Assessment AnalystDuration: 1 hStudents will confirm the validity of event-data analysis to eliminate false-positive events.
Hands-on labStationX Membership
Conduct Supplemental MonitoringCyber Defense Forensics Analyst Training Series + 1 more blockDuration: 1 hIn this lab you implement supplemental monitoring solutions on a network using various Microsoft security tools and built-ins.Hands-on labStationX Membership
Core Impact Web Application Penetration TestingVulnerability Assessment AnalystDuration: 1 hThis lab introduces students to the web application penetration testing suite within the Core Impact application.
Hands-on labStationX Membership
Create Custom Snort RulesNetwork Intrusion DetectionDuration: 1 hYou will configure snort as an IDS.Hands-on labStationX Membership
Creating Recommendations Based on Vulnerability AssessmentsVulnerability Assessment AnalystDuration: 1 hStudents will use nmap and OpenVAS / Greenbone Vulnerability Scanner to confirm old vulnerable systems and discover new ones.Hands-on labStationX Membership
Cryptography: SteganographyCyber Defense Forensics Analyst Training Series + 1 more blockDuration: 2 hIn this lab, students will learn: How information can be hidden in cover files.Hands-on labStationX Membership
Cryptography: Using GPG for Encryption and Key ManagementCyber Defense Forensics Analyst Training Series + 1 more blockDuration: 1 hTraining on how to use GPG with a GPG challenge at the end.Hands-on labStationX Membership
Cyber Security Evaluation Tool (CSET)Threat Intelligence & DefenseDuration: 5 hIn this lab students will learn to use the Cyber Security Evaluation Tool (CSET) to evaluate the security posture of an enterprise environment.Hands-on labStationX Membership
Data Recovery with AutopsyCyber Defense Forensics Analyst Training Series + 1 more blockDuration: 1 hStudents will ingest and process a previously acquired forensic image using Autopsy.Hands-on labStationX Membership
Dynamic Malware AnalysisCyber Defense Forensics Analyst Training Series + 2 more blocksDuration: 1 hStudents will use utilize two virtual machines, inside a protected network, to observe configuration changes on a known good / clean system and all of the unusual network traffic generated by the…Hands-on labStationX Membership
Entering Information into a CMDBThreat Intelligence & DefenseDuration: 1 hStudents will review an old asset list and enter all of the contained information into a Configuration Management Database (CMDB).Hands-on labStationX Infrastructure Labs
Evaluate and Customize Security Policy TemplatesCyber Security Incident ResponseLevel: GuidedDuration: 30 minIn this lab, you will learn how to evaluate security policy, guides, and templates.Hands-on labStationX Membership
Event Logs with AutopsyThreat Intelligence & DefenseDuration: 1 hIn this hands-on lab, students will learn the fundamentals of Windows Event Logs, including their purpose, structure, and the types of information they contain.Hands-on labStationX Infrastructure Labs
Explore Network Traffic by Using WiresharkCyber Security Incident ResponseLevel: GuidedDuration: 30 minIn this lab, you will examine network communications by using Wireshark.Hands-on labStationX Infrastructure Labs
Find Network System VulnerabilitiesCyber Security Incident ResponseLevel: GuidedDuration: 30 minIn this lab, you will perform an uncredentialed vulnerability scan, and then you will perform credentialed vulnerability scans.Hands-on labStationX Membership
Firewall Setup and ConfigurationCyber Defense Incident Responder + 1 more blockDuration: 1 hIn this lab you will perform the steps necessary to set up a pfSense firewall from the basic command line interface and then configure the firewall using the web configuration GUI on a Windows…Hands-on labStationX Membership
Gap Analysis of Firewall RulesVulnerability Assessment AnalystDuration: 2 hStudents will log into an organization's firewall, document existing firewall rules, analyze these rules and making recommendations based on this analysis.Hands-on labStationX Membership
Hash VerificationCyber Defense Forensics Analyst Training Series + 1 more blockDuration: 1 hIn this lab, students will understand and use hash verification to identify and compare files and forensic images.Hands-on labStationX Membership
Identify Whether High-Risk Systems Were AffectedCyber Defense Incident Responder + 1 more blockDuration: 1 hThe highest risk systems are the ones with Internet facing Applications.Hands-on labStationX Membership
Identifying System Vulnerabilities with OpenVASVulnerability Assessment AnalystDuration: 2 hStudents will scan a system in OpenVAS (Open Vulnerability Assessment) to discover and identify systems on the network that have vulnerabilities.Hands-on labStationX Infrastructure Labs
Implement New Security PoliciesCyber Security Incident ResponseLevel: GuidedDuration: 30 minIn this lab, you will implement new security policies.Hands-on labStationX Membership
Implement Single System Changes in FirewallCyber Defense Incident ResponderDuration: 1 hIn this lab, you will make changes to the pfSense firewall in order to block specific ports and types of traffic.Hands-on labStationX Membership
Implementing Least-Privilege on WindowsVulnerability Assessment AnalystDuration: 1 hLeast-privilege is an important concept across many domains (e.g., Windows server/workstation management, networking, Linux management, etc.) and requires great discipline to implement properly.Hands-on labStationX Membership
Installing Patches and Testing SoftwareCyber Defense Incident ResponderDuration: 2 hStudents will identify if a vulnerability is present in the systems and remediate the vulnerability if necessary.Hands-on labStationX Membership
Internet HistoryThreat Intelligence & DefenseDuration: 1 hIn this lab, students will learn how to locate, extract, and analyze internet history artifacts from a forensic disk image.Hands-on labStationX Membership
Introduction to SquertCyber Defense Forensics Analyst Training Series + 1 more blockDuration: 1 hIn this lab, you will learn how to use Squert to view previously generated event data detected by the sensors.Hands-on labStationX Membership
Log Event ReportsCyber Defense Forensics Analyst Training Series + 1 more blockDuration: 1 hIn this lab, students will identify and analyze event logs across multiple systems, learning where logs are stored and how to filter them for relevant events.Hands-on labStationX Membership
Manual Vulnerability AssessmentCyber Defense Forensics Analyst Training Series + 1 more blockDuration: 1 hAs part of the defense in depth model it is vitally important to keep tabs on the events occurring on individual devices/systems.Hands-on labStationX Membership
Manually Creating a Baseline with MD5DeepCyber Defense Forensics Analyst Training Series + 1 more blockDuration: 1 hStudents will create a baseline on a documents folder using md5deep.Hands-on labStationX Membership
Microsoft Baseline Security AnalyzerCyber Defense Incident ResponderDuration: 1 hIn this lab you will use Microsoft Baseline Security Analyzer (MBSA) to perform scans of individual host computers and of groups of computers.Hands-on labStationX Membership
MITRE - AttackNetwork Intrusion DetectionDuration: 1 hThis lab demonstrates the process that Advanced Persistent Threat (APT) actors use to gain initial access to organizations using phishing campaigns and malicious documents.Hands-on labStationX Membership
MITRE - DefendThreat Intelligence & DefenseDuration: 1 hThis lab is designed to teach defenders how to use Mitre ATT&CK and Mitre Navigator to research potential APTs that will target their organization and how to prioritize their defensive efforts.Hands-on labStationX Membership
Monitoring for False PositivesNetwork Intrusion DetectionDuration: 1 hIn this lab we will map a drive to a share on the network and then copy resources from a file server.Hands-on labStationX Membership
Monitoring Network TrafficCyber Defense Incident Responder + 1 more blockDuration: 1 hIn this hands-on lab, students will learn how to monitor and analyze network activity using a combination of industry-standard security tools.Hands-on labStationX Membership
Monitoring Network Traffic for Potential IOA/IOCNetwork Intrusion DetectionDuration: 1 hIn this lab we will replicate potentially malicious scans from the Internet against a corporate asset.Hands-on labStationX Membership
Network DiscoveryCyber Defense Incident Responder + 1 more blockDuration: 2 hThe Network Discovery lab is designed to help students facilitate open source collection by teaching them how to use more intimate network discovery techniques.Hands-on labStationX Membership
Network Segmentation (FW/DMZ/WAN/LAN)Cyber Defense Incident Responder + 1 more blockDuration: 1 hCreate three distinct areas for this network, route traffic accordingly and lock down VPN access to the appropriate IP address.Hands-on labStationX Membership
Network Topology GenerationCyber Defense Incident ResponderDuration: 2 hIn this hands-on lab, students will gain practical experience using Zenmap, the graphical interface for Nmap, to perform network discovery and reconnaissance.Hands-on labStationX Membership
Nexpose: Red Team ExploitationThreat Intelligence & DefenseDuration: 1 hThe Nexpose red team exploitation lab exposes student to the impact of critical network threats from an attacker perspective.
Hands-on labStationX Membership
Open Source Password CrackingForensic Investigations and Evidence Handling + 1 more blockDuration: 1 hStudents will use John the Ripper and Cain and Abel to crack various password protected file types on a Windows machine.Hands-on labStationX Membership
Overview of KibanaCyber Defense Forensics Analyst Training Series + 2 more blocksDuration: 1 hStudents will become familiarized with data visualization using Kibana - one of the 3 tools included in Elastic's ELK stack, a trio of open-source applications that work together in order to meet a…Hands-on labStationX Membership
Penetration Tester ChallengeVulnerability Assessment AnalystDuration: 3 hHack the Network and Deface the Web ServerHands-on labStationX Infrastructure Labs
Perform Backup Options to Allow for Lost File RestorationCyber Security Incident ResponseLevel: GuidedDuration: 30 minIn this lab, you will protect files with backup options to allow for restoration.Hands-on labStationX Infrastructure Labs
Perform Log Analysis and Task AutomationCyber Security Incident ResponseLevel: GuidedDuration: 30 minIn this lab you will learn how to perform log analysis, as well as how to automate some log tasks.Hands-on labStationX Infrastructure Labs
Perform Open Source Intelligence (OSINT) Gathering OperationsCyber Security Incident ResponseLevel: GuidedDuration: 30 minIn this lab, you will perform open-source intelligence (OSINT)-gathering operations.Hands-on labStationX Membership
Performing an Initial Attack AnalysisThreat Intelligence & Defense + 1 more blockDuration: 1 hStudents will use perform incident response on a compromised machine.Hands-on labStationX Membership
Preliminary ScanningCyber Defense Forensics Analyst Training Series + 1 more blockDuration: 1 hStudents will utilize Nmap, a network discovery and mapping tool, to identify the systems on a network of responsibility.Hands-on labStationX Membership
Preparing Target MediaThreat Intelligence & DefenseDuration: 1 hIn this lab, students will prepare target media for imaging using dc3dd and Disk Wipe.Hands-on labStationX Membership
Recover from Illegal Bitcoin Mining IncidentThreat Intelligence & DefenseDuration: 1 hStudents will conduct recovery activities using Indicators of Compromise found on the victim computer and other network-related artifacts.Hands-on labStationX Membership
Recover from IncidentCyber Defense Forensics Analyst Training Series + 2 more blocksDuration: 2 hThis lab covers a variety of concepts, and exercises static and dynamic analysis skills related to malware identification and eradication.
Hands-on labStationX Membership
Recover from Web-Based Flashpack IncidentThreat Intelligence & DefenseDuration: 1 hStudents will recover a Windows 7 client infected by an unknown payload loaded after exposure to the FlashPack Exploit Kit.Hands-on labStationX Membership
Report Writing for Presentation to ManagementCyber Defense Incident Responder + 1 more blockDuration: 1 hIn an earlier lab, students analyzed a suspected exploit (FlashPack Exploit Kit) on a corporate machine.Hands-on labStationX Membership
Respond to and Validate Alerts from Antivirus SoftwareThreat Intelligence & DefenseDuration: 1 hStudents will respond to and validate alerts from Antivirus software.Hands-on labStationX Membership
Setting up Filters and Queries in KibanaCyber Defense Forensics Analyst Training Series + 1 more blockDuration: 1 hStudents will focus on using filters and queries in Kibana to find indicators of compromise within the network.Hands-on labStationX Membership
Setting Up Zones in a FirewallCyber Defense Incident ResponderDuration: 1 hStudents will configure a pfSense Firewall to create/isolate various network segments.Hands-on labStationX Membership
SNORT Configuration and Operation LabNetwork Intrusion Detection + 1 more blockDuration: 1 hThis lab will provide the student with experience in manually installing Snort and its support software, as well as with configuring Snort to behave as a Network Intrusion Detection System.Hands-on labStationX Membership
Threat DesignationCyber Defense Forensics Analyst Training Series + 2 more blocksDuration: 1 hStudents will conduct scans against a web server, a file share, a printer and a user's host device.Hands-on labStationX Membership
Using Snort and Wireshark to Analyze TrafficCyber Defense Forensics Analyst Training Series + 1 more blockDuration: 1 hIn this lab we will replicate the need for Analysts to be able to analyze network traffic and detect suspicious activity.Hands-on labStationX Membership
Validate Indications of Compromise: Analysis of PE FileCyber Defense Forensics Analyst Training Series + 2 more blocksDuration: 1 hMalware authors frequently use certain functions, symbols and other tools as a way of building and obfuscating the true nature of their executables.Hands-on labStationX Membership
Vulnerability Analysis/ProtectionCyber Defense Incident ResponderDuration: 3 hStudents will use OpenVAS to do a vulnerability analysis.Hands-on labStationX Membership
Vulnerability Proof of Concept and RemediationVulnerability Assessment AnalystDuration: 1 hStudents will identify if a vulnerability is present in the systems and remediate the vulnerability if necessary.Hands-on labStationX Membership
Vulnerability Scanning with GVMVulnerability Assessment AnalystDuration: 2 hStudents will conduct a vulnerability scan utilizing Greenbone Vulnerability Management (GVM), generate a vulnerability report, and review the vulnerabilities identified in the report.Hands-on labStationX Membership
WebApp Attack PCAP AnalysisCyber Defense Forensics Analyst Training Series + 1 more blockDuration: 1 hIn this lab you will analyze a capture file of a web application attack in order to identify the attack vector and deduce the vulnerability the attack exploited.Hands-on labStationX Membership
Windows Event Log Manipulation via Windows Event ViewerCyber Defense Incident ResponderDuration: 1 hIn this lab you will use Windows Event Viewer to view and filter the security event log on a Windows 7 client computer specifically for account logons.Hands-on labStationX Membership
Windows System Hardening with Group Policy & Active DirectoryCyber Defense Forensics Analyst Training Series + 2 more blocksDuration: 2 hIn this hands-on lab, students will learn how to strengthen and manage a Windows domain environment using Active Directory and Group Policy.Page 1 of 2 · Next →