Browse everything

Roadmaps, courses and hands-on labs — search or filter. All roadmaps · Lab catalogue

Filters 2

Filter results

Type: Hands-on labTopic: Blue TeamClear all

199 results — showing 1–100

Hands-on labStationX Membership

Auditing Service Accounts and Setting Up Automated Log CollectionCritical Security Controls + 2 more blocksDuration: 2 hStudents will explore information-gathering techniques, audit service accounts in a Windows Environment, collect Windows logs, and automate log transfer with Syslog.

Hands-on labStationX Membership

BitLocker SetupCritical Security ControlsDuration: 1 hThis lab shows the student how to setup BitLocker on a Windows 8.1 Professional system.

Hands-on labStationX Membership

Centralized MonitoringCritical Security Controls + 1 more blockDuration: 1 hIn this lab, students will learn how to ingest log data into Splunk by first manually uploading log files for analysis.

Hands-on labStationX Membership

CIRP Creation and DisasterCritical Security ControlsDuration: 2 hStudents will become familiar with the creation of a Cyber Incident Response Plan (CIRP).

Hands-on labStationX Membership

Comparing ControlsCritical Security ControlsDuration: 1 hStudents will evaluate policies in place on a domain and apply those policies in accordance to organizational standards.

Hands-on labStationX Membership

Creation of Standard Operating Procedures for RecoveryCritical Security ControlsDuration: 1 hStudents will have access to the results of a vulnerability scan run again a sample Windows 2008 Server.

Hands-on labStationX Membership

Data Backup to Prep for RecoveryCritical Security Controls + 3 more blocksDuration: 1 hIn this lab we will simulate the recovery phase where we must perform a backup in a server environment.

Hands-on labStationX Membership

Data Downloads and ValidationCritical Security ControlsDuration: 1 hIn this lab, students will learn to validate downloads to mitigate risk.

Hands-on labStationX Membership

Force Point: DLP Email OverviewCritical Security ControlsDuration: 1 hForcepoint DLP will teach the student how to configure Forcepoint DLP to stop data loss on the email channel.

Hands-on labStationX Membership

Force Point: DLP Network OverviewCritical Security ControlsDuration: 1 hDLP network: Monitors and enforces DLP policies across several communication channels, including email, web, IM, network printing.

Hands-on labStationX Membership

Identifying Key AssetsCritical Security ControlsDuration: 1 hStudents will use nmap to identify specific assets on their network.

Hands-on labStationX Membership

Leveraging Internal Intelligence ResourcesCritical Security ControlsDuration: 1 hStudents will leverage Zenmap and Tenable Nessus vulnerability scanner in order to perform an internal scan of networked resources.

Hands-on labStationX Membership

Log Correlation & Analysis to Identify Potential IOCCritical Security ControlsDuration: 1 hWhen defending networked digital systems, attention must be paid to the logging mechanisms set in place to detect suspicious behavior.

Hands-on labStationX Membership

Monitoring and Verifying Management SystemsCritical Security Controls + 1 more blockDuration: 1 hIn this lab, students will use Nessus Essentials to assess a system for vulnerabilities and generate a detailed analysis report.

Hands-on labStationX Membership

Open and Close Ports on Windows 7Critical Security ControlsDuration: 1 hIn this lab, the student will kill some processes and close down some shares in response to a suspected threat.

Hands-on labStationX Membership

Phishing (2026)Critical Security ControlsDuration: 1 hIn this hands-on lab, students will explore the fundamentals of phishing attacks and user awareness by using the Social-Engineer Toolkit (SET) to create a phishing email and simulate a real-world…

Hands-on labStationX Membership

PhishingCritical Security Controls + 1 more blockDuration: 1 hStudents will send a phishing email using the Social Engineering Toolkit.

Hands-on labStationX Membership

Post Incident Service RestorationCritical Security ControlsDuration: 1 hIn this lab, students will focus on the recovery phase of incident response by restoring critical services on a compromised host in a post-incident environment.

Hands-on labStationX Membership

RansomwareCritical Security ControlsDuration: 1 hStudents will learn what ransomware is, observe how it works, and implement mitigation strategies to recover from a ransomware attack.

Hands-on labStationX Membership

Recover from SQL Injection AttackCritical Security ControlsDuration: 1 hAfter identifying a SQL Injection attack, students will learn about parameterized queries in back-end web servers to minimize future SQLi attacks.

Hands-on labStationX Membership

Sensitive Information IdentificationCritical Security ControlsDuration: 1 hStudents will utilize Data Loss Prevention (DLP) software to identify documents potentially containing sensitive information.

Hands-on labStationX Membership

Vulnerability Identification and RemediationCritical Security ControlsDuration: 1 hLearners will use Nmap and OpenVAS/Greenbone Vulnerability Scanner to confirm old vulnerable systems and to also discover new ones.

Hands-on labStationX Membership

Analyze and Update a Company BCP/BIA/DRP/CIRPCyber Defense Incident Responder + 2 more blocksDuration: 2 hStudents will become familiar with the Business Continuity Plan (BCP), Business Impact Assessment (BIA), Disaster Recovery Plan (DRP) and Computer Incident Response Plan (CIRP).

Hands-on labStationX Membership

Analyze SQL Injection AttackCyber Defense Incident Responder + 1 more blockDuration: 1 hStudents will Identify the use of an SQL Injection through the use of Wireshark.

Hands-on labStationX Membership

Analyze Various Data Sources to Confirm Suspected InfectionThreat Intelligence & DefenseDuration: 1 hStudents will review network traffic to confirm the presence of malicious activity using various tools including Wireshark and VirusTotal.com.

Hands-on labStationX Membership

Applying Filters to TCPDump and WiresharkCyber Defense Incident ResponderDuration: 1 hThis lab exercise is designed to allow the trainee to become familiar with applying a capture filter to TCPDump and Wireshark using Berkley Packet Filter (BPF) syntax.

Hands-on labStationX Membership

Assessing Vulnerabilities Post AddressalThreat Intelligence & DefenseDuration: 1 hStudents will use Snorby against multiple systems to identify and mitigate any vulnerabilities found.

Hands-on labStationX Membership

BitCoin Mining Web Application on Corporate NetworkThreat Intelligence & DefenseDuration: 1 hStudents will identify unauthorized activity on a corporate network.

Hands-on labStationX Membership

Block Incoming Traffic on Known PortCyber Defense Incident ResponderDuration: 1 hIn this lab, the student will respond to an incident by blocking incoming traffic on a known port from a specific IP.

Hands-on labStationX Infrastructure Labs

Can You Examine Network Communications by Using Incident Response Tools?Cyber Security Incident ResponseLevel: AdvancedDuration: 45 minIn this lab, you will examine network communications by using incident response tools.

Hands-on labStationX Infrastructure Labs

Can You Manage Logs with Scripts, Perform File Restoration, and Perform Vulnerability Scans?Cyber Security Incident ResponseLevel: AdvancedDuration: 45 minIn this lab, you will manage logs with scripts, perform file restoration, and perform vulnerability scans.

Hands-on labStationX Infrastructure Labs

Can You Perform File Restoration, Manage GPOs, and Perform OSINT?Cyber Security Incident ResponseLevel: ExpertDuration: 1 hIn this lab, First, you will prepare for backup operations, and then you will configure Windows File History and perform a backup.

Hands-on labStationX Infrastructure Labs

Can You Use GPOs and Security Templates as Part of IR?Cyber Security Incident ResponseLevel: AdvancedDuration: 1 hIn this lab, you will use GPOs and security templates as part of IR.

Hands-on labStationX Membership

Check for Indicators of Other Attack Activity (Debug PE File)Threat Intelligence & DefenseDuration: 2 hStudents will check for indications of other attack activity.

Hands-on labStationX Membership

Comprehensive Threat ResponseCyber Defense Incident Responder + 2 more blocksDuration: 2 hIn this final lab, we will attempt to exercise all the relevant skills found in this domain.

Hands-on labStationX Membership

Conduct Log Analysis and Cross Examination for False PositivesVulnerability Assessment AnalystDuration: 1 hStudents will confirm the validity of event-data analysis to eliminate false-positive events.

Hands-on labStationX Membership

Conduct Supplemental MonitoringCyber Defense Forensics Analyst Training Series + 1 more blockDuration: 1 hIn this lab you implement supplemental monitoring solutions on a network using various Microsoft security tools and built-ins.

Hands-on labStationX Membership

Core Impact Web Application Penetration TestingVulnerability Assessment AnalystDuration: 1 hThis lab introduces students to the web application penetration testing suite within the Core Impact application.

Hands-on labStationX Membership

Create Custom Snort RulesNetwork Intrusion DetectionDuration: 1 hYou will configure snort as an IDS.

Hands-on labStationX Membership

Creating Recommendations Based on Vulnerability AssessmentsVulnerability Assessment AnalystDuration: 1 hStudents will use nmap and OpenVAS / Greenbone Vulnerability Scanner to confirm old vulnerable systems and discover new ones.

Hands-on labStationX Membership

Cryptography: SteganographyCyber Defense Forensics Analyst Training Series + 1 more blockDuration: 2 hIn this lab, students will learn: How information can be hidden in cover files.

Hands-on labStationX Membership

Cryptography: Using GPG for Encryption and Key ManagementCyber Defense Forensics Analyst Training Series + 1 more blockDuration: 1 hTraining on how to use GPG with a GPG challenge at the end.

Hands-on labStationX Membership

Cyber Security Evaluation Tool (CSET)Threat Intelligence & DefenseDuration: 5 hIn this lab students will learn to use the Cyber Security Evaluation Tool (CSET) to evaluate the security posture of an enterprise environment.

Hands-on labStationX Membership

Data Recovery with AutopsyCyber Defense Forensics Analyst Training Series + 1 more blockDuration: 1 hStudents will ingest and process a previously acquired forensic image using Autopsy.

Hands-on labStationX Membership

Dynamic Malware AnalysisCyber Defense Forensics Analyst Training Series + 2 more blocksDuration: 1 hStudents will use utilize two virtual machines, inside a protected network, to observe configuration changes on a known good / clean system and all of the unusual network traffic generated by the…

Hands-on labStationX Membership

Entering Information into a CMDBThreat Intelligence & DefenseDuration: 1 hStudents will review an old asset list and enter all of the contained information into a Configuration Management Database (CMDB).

Hands-on labStationX Infrastructure Labs

Evaluate and Customize Security Policy TemplatesCyber Security Incident ResponseLevel: GuidedDuration: 30 minIn this lab, you will learn how to evaluate security policy, guides, and templates.

Hands-on labStationX Membership

Event Logs with AutopsyThreat Intelligence & DefenseDuration: 1 hIn this hands-on lab, students will learn the fundamentals of Windows Event Logs, including their purpose, structure, and the types of information they contain.

Hands-on labStationX Infrastructure Labs

Explore Network Traffic by Using WiresharkCyber Security Incident ResponseLevel: GuidedDuration: 30 minIn this lab, you will examine network communications by using Wireshark.

Hands-on labStationX Infrastructure Labs

Find Network System VulnerabilitiesCyber Security Incident ResponseLevel: GuidedDuration: 30 minIn this lab, you will perform an uncredentialed vulnerability scan, and then you will perform credentialed vulnerability scans.

Hands-on labStationX Membership

Firewall Setup and ConfigurationCyber Defense Incident Responder + 1 more blockDuration: 1 hIn this lab you will perform the steps necessary to set up a pfSense firewall from the basic command line interface and then configure the firewall using the web configuration GUI on a Windows…

Hands-on labStationX Membership

Gap Analysis of Firewall RulesVulnerability Assessment AnalystDuration: 2 hStudents will log into an organization's firewall, document existing firewall rules, analyze these rules and making recommendations based on this analysis.

Hands-on labStationX Membership

Hash VerificationCyber Defense Forensics Analyst Training Series + 1 more blockDuration: 1 hIn this lab, students will understand and use hash verification to identify and compare files and forensic images.

Hands-on labStationX Membership

Identify Whether High-Risk Systems Were AffectedCyber Defense Incident Responder + 1 more blockDuration: 1 hThe highest risk systems are the ones with Internet facing Applications.

Hands-on labStationX Membership

Identifying System Vulnerabilities with OpenVASVulnerability Assessment AnalystDuration: 2 hStudents will scan a system in OpenVAS (Open Vulnerability Assessment) to discover and identify systems on the network that have vulnerabilities.

Hands-on labStationX Infrastructure Labs

Implement New Security PoliciesCyber Security Incident ResponseLevel: GuidedDuration: 30 minIn this lab, you will implement new security policies.

Hands-on labStationX Membership

Implement Single System Changes in FirewallCyber Defense Incident ResponderDuration: 1 hIn this lab, you will make changes to the pfSense firewall in order to block specific ports and types of traffic.

Hands-on labStationX Membership

Implementing Least-Privilege on WindowsVulnerability Assessment AnalystDuration: 1 hLeast-privilege is an important concept across many domains (e.g., Windows server/workstation management, networking, Linux management, etc.) and requires great discipline to implement properly.

Hands-on labStationX Membership

Installing Patches and Testing SoftwareCyber Defense Incident ResponderDuration: 2 hStudents will identify if a vulnerability is present in the systems and remediate the vulnerability if necessary.

Hands-on labStationX Membership

Internet HistoryThreat Intelligence & DefenseDuration: 1 hIn this lab, students will learn how to locate, extract, and analyze internet history artifacts from a forensic disk image.

Hands-on labStationX Membership

Introduction to SquertCyber Defense Forensics Analyst Training Series + 1 more blockDuration: 1 hIn this lab, you will learn how to use Squert to view previously generated event data detected by the sensors.

Hands-on labStationX Membership

Log Event ReportsCyber Defense Forensics Analyst Training Series + 1 more blockDuration: 1 hIn this lab, students will identify and analyze event logs across multiple systems, learning where logs are stored and how to filter them for relevant events.

Hands-on labStationX Membership

Manual Vulnerability AssessmentCyber Defense Forensics Analyst Training Series + 1 more blockDuration: 1 hAs part of the defense in depth model it is vitally important to keep tabs on the events occurring on individual devices/systems.

Hands-on labStationX Membership

Manually Creating a Baseline with MD5DeepCyber Defense Forensics Analyst Training Series + 1 more blockDuration: 1 hStudents will create a baseline on a documents folder using md5deep.

Hands-on labStationX Membership

Microsoft Baseline Security AnalyzerCyber Defense Incident ResponderDuration: 1 hIn this lab you will use Microsoft Baseline Security Analyzer (MBSA) to perform scans of individual host computers and of groups of computers.

Hands-on labStationX Membership

MITRE - AttackNetwork Intrusion DetectionDuration: 1 hThis lab demonstrates the process that Advanced Persistent Threat (APT) actors use to gain initial access to organizations using phishing campaigns and malicious documents.

Hands-on labStationX Membership

MITRE - DefendThreat Intelligence & DefenseDuration: 1 hThis lab is designed to teach defenders how to use Mitre ATT&CK and Mitre Navigator to research potential APTs that will target their organization and how to prioritize their defensive efforts.

Hands-on labStationX Membership

Monitoring for False PositivesNetwork Intrusion DetectionDuration: 1 hIn this lab we will map a drive to a share on the network and then copy resources from a file server.

Hands-on labStationX Membership

Monitoring Network TrafficCyber Defense Incident Responder + 1 more blockDuration: 1 hIn this hands-on lab, students will learn how to monitor and analyze network activity using a combination of industry-standard security tools.

Hands-on labStationX Membership

Monitoring Network Traffic for Potential IOA/IOCNetwork Intrusion DetectionDuration: 1 hIn this lab we will replicate potentially malicious scans from the Internet against a corporate asset.

Hands-on labStationX Membership

Network DiscoveryCyber Defense Incident Responder + 1 more blockDuration: 2 hThe Network Discovery lab is designed to help students facilitate open source collection by teaching them how to use more intimate network discovery techniques.

Hands-on labStationX Membership

Network Segmentation (FW/DMZ/WAN/LAN)Cyber Defense Incident Responder + 1 more blockDuration: 1 hCreate three distinct areas for this network, route traffic accordingly and lock down VPN access to the appropriate IP address.

Hands-on labStationX Membership

Network Topology GenerationCyber Defense Incident ResponderDuration: 2 hIn this hands-on lab, students will gain practical experience using Zenmap, the graphical interface for Nmap, to perform network discovery and reconnaissance.

Hands-on labStationX Membership

Nexpose: Red Team ExploitationThreat Intelligence & DefenseDuration: 1 hThe Nexpose red team exploitation lab exposes student to the impact of critical network threats from an attacker perspective.

Hands-on labStationX Membership

Open Source Password CrackingForensic Investigations and Evidence Handling + 1 more blockDuration: 1 hStudents will use John the Ripper and Cain and Abel to crack various password protected file types on a Windows machine.

Hands-on labStationX Membership

Overview of KibanaCyber Defense Forensics Analyst Training Series + 2 more blocksDuration: 1 hStudents will become familiarized with data visualization using Kibana - one of the 3 tools included in Elastic's ELK stack, a trio of open-source applications that work together in order to meet a…

Hands-on labStationX Membership

Penetration Tester ChallengeVulnerability Assessment AnalystDuration: 3 hHack the Network and Deface the Web Server

Hands-on labStationX Infrastructure Labs

Perform Backup Options to Allow for Lost File RestorationCyber Security Incident ResponseLevel: GuidedDuration: 30 minIn this lab, you will protect files with backup options to allow for restoration.

Hands-on labStationX Infrastructure Labs

Perform Log Analysis and Task AutomationCyber Security Incident ResponseLevel: GuidedDuration: 30 minIn this lab you will learn how to perform log analysis, as well as how to automate some log tasks.

Hands-on labStationX Infrastructure Labs

Perform Open Source Intelligence (OSINT) Gathering OperationsCyber Security Incident ResponseLevel: GuidedDuration: 30 minIn this lab, you will perform open-source intelligence (OSINT)-gathering operations.

Hands-on labStationX Membership

Performing an Initial Attack AnalysisThreat Intelligence & Defense + 1 more blockDuration: 1 hStudents will use perform incident response on a compromised machine.

Hands-on labStationX Membership

Preliminary ScanningCyber Defense Forensics Analyst Training Series + 1 more blockDuration: 1 hStudents will utilize Nmap, a network discovery and mapping tool, to identify the systems on a network of responsibility.

Hands-on labStationX Membership

Preparing Target MediaThreat Intelligence & DefenseDuration: 1 hIn this lab, students will prepare target media for imaging using dc3dd and Disk Wipe.

Hands-on labStationX Membership

Recover from Illegal Bitcoin Mining IncidentThreat Intelligence & DefenseDuration: 1 hStudents will conduct recovery activities using Indicators of Compromise found on the victim computer and other network-related artifacts.

Hands-on labStationX Membership

Recover from IncidentCyber Defense Forensics Analyst Training Series + 2 more blocksDuration: 2 hThis lab covers a variety of concepts, and exercises static and dynamic analysis skills related to malware identification and eradication.

Hands-on labStationX Membership

Recover from Web-Based Flashpack IncidentThreat Intelligence & DefenseDuration: 1 hStudents will recover a Windows 7 client infected by an unknown payload loaded after exposure to the FlashPack Exploit Kit.

Hands-on labStationX Membership

Report Writing for Presentation to ManagementCyber Defense Incident Responder + 1 more blockDuration: 1 hIn an earlier lab, students analyzed a suspected exploit (FlashPack Exploit Kit) on a corporate machine.

Hands-on labStationX Membership

Respond to and Validate Alerts from Antivirus SoftwareThreat Intelligence & DefenseDuration: 1 hStudents will respond to and validate alerts from Antivirus software.

Hands-on labStationX Membership

Setting up Filters and Queries in KibanaCyber Defense Forensics Analyst Training Series + 1 more blockDuration: 1 hStudents will focus on using filters and queries in Kibana to find indicators of compromise within the network.

Hands-on labStationX Membership

Setting Up Zones in a FirewallCyber Defense Incident ResponderDuration: 1 hStudents will configure a pfSense Firewall to create/isolate various network segments.

Hands-on labStationX Membership

SNORT Configuration and Operation LabNetwork Intrusion Detection + 1 more blockDuration: 1 hThis lab will provide the student with experience in manually installing Snort and its support software, as well as with configuring Snort to behave as a Network Intrusion Detection System.

Hands-on labStationX Membership

Threat DesignationCyber Defense Forensics Analyst Training Series + 2 more blocksDuration: 1 hStudents will conduct scans against a web server, a file share, a printer and a user's host device.

Hands-on labStationX Membership

Using Snort and Wireshark to Analyze TrafficCyber Defense Forensics Analyst Training Series + 1 more blockDuration: 1 hIn this lab we will replicate the need for Analysts to be able to analyze network traffic and detect suspicious activity.

Hands-on labStationX Membership

Validate Indications of Compromise: Analysis of PE FileCyber Defense Forensics Analyst Training Series + 2 more blocksDuration: 1 hMalware authors frequently use certain functions, symbols and other tools as a way of building and obfuscating the true nature of their executables.

Hands-on labStationX Membership

Vulnerability Analysis/ProtectionCyber Defense Incident ResponderDuration: 3 hStudents will use OpenVAS to do a vulnerability analysis.

Hands-on labStationX Membership

Vulnerability Proof of Concept and RemediationVulnerability Assessment AnalystDuration: 1 hStudents will identify if a vulnerability is present in the systems and remediate the vulnerability if necessary.

Hands-on labStationX Membership

Vulnerability Scanning with GVMVulnerability Assessment AnalystDuration: 2 hStudents will conduct a vulnerability scan utilizing Greenbone Vulnerability Management (GVM), generate a vulnerability report, and review the vulnerabilities identified in the report.

Hands-on labStationX Membership

WebApp Attack PCAP AnalysisCyber Defense Forensics Analyst Training Series + 1 more blockDuration: 1 hIn this lab you will analyze a capture file of a web application attack in order to identify the attack vector and deduce the vulnerability the attack exploited.

Hands-on labStationX Membership

Windows Event Log Manipulation via Windows Event ViewerCyber Defense Incident ResponderDuration: 1 hIn this lab you will use Windows Event Viewer to view and filter the security event log on a Windows 7 client computer specifically for account logons.

Hands-on labStationX Membership

Windows System Hardening with Group Policy & Active DirectoryCyber Defense Forensics Analyst Training Series + 2 more blocksDuration: 2 hIn this hands-on lab, students will learn how to strengthen and manage a Windows domain environment using Active Directory and Group Policy.

Browse everything

Filter results

Type

Lab difficulty

Duration

Exam

Topic

Included in