Browse everything
Roadmaps, courses and hands-on labs — search or filter. All roadmaps · Lab catalogue
Filters 3
275 results — showing 1–100
Hands-on labStationX Membership
Additional Scanning OptionsCyber Defense Analyst Training Series + 2 more blocksDuration: 1 hStudents will leverage Nmap, a network discovery and mapping tool, to identify the systems on a network of responsibility.
Hands-on labStationX Membership
Applying Filters to TCPDump and WiresharkCyber Defense Analyst Training Series + 5 more blocksDuration: 1 hThis lab exercise is designed to allow the trainee to become familiar with applying a capture filter to TCPDump and Wireshark using Berkley Packet Filter (BPF) syntax.
Hands-on labStationX Membership
Baseline Systems in Accordance with Policy DocumentationCyber Defense Forensics Analyst Training Series + 4 more blocksDuration: 1 hStudents are provided a whitelist of applications allowed for installation on a system.
Hands-on labStationX Membership
BitLocker SetupCritical Security Controls + 1 more blockDuration: 1 hThis lab shows the student how to setup BitLocker on a Windows 8.1 Professional system.
Hands-on labStationX Membership
Block Incoming Traffic on Known PortCyber Defense Analyst Training Series + 5 more blocksDuration: 1 hIn this lab, the student will respond to an incident by blocking incoming traffic on a known port from a specific IP.Hands-on labStationX Membership
Centralized MonitoringCritical Security Controls + 2 more blocksDuration: 1 hIn this lab, students will learn how to ingest log data into Splunk by first manually uploading log files for analysis.Hands-on labStationX Membership
Comparing ControlsCritical Security Controls + 3 more blocksDuration: 1 hStudents will evaluate policies in place on a domain and apply those policies in accordance to organizational standards.
Hands-on labStationX Membership
Conduct Baseline Comparison for Indicators of CompromiseCyber Security Professional + 1 more blockDuration: 1 hLearners will create a system baseline operating snapshot using the Window Forensic Toolchest (WFT) and compare it against a previously created baseline using the KDiff3 application to identify any…Hands-on labStationX Membership
Creating a Baseline Using AutopsyCyber Defense Forensics Analyst Training Series + 2 more blocksDuration: 1 hStudents will run Autopsy against an existing system to create a baseline that will be used for future analysis.Hands-on labStationX Membership
Creating a List of Installed Programs, Services and User Accounts from a WIN2K12 ServerCyber Defense Forensics Analyst Training Series + 5 more blocksDuration: 1 hStudents will create a list of installed programs, services, and accounts in a Windows 2012 server environment using various tools and methods.
Hands-on labStationX Membership
Creating a Secondary Baseline and Conducting ComparisonCyber Security Professional + 1 more blockDuration: 1 hStudents will create a second baseline using Autopsy and compare it against a previously created baseline using KDiff3.Hands-on labStationX Membership
Creation of Standard Operating Procedures for RecoveryCritical Security Controls + 1 more blockDuration: 1 hStudents will have access to the results of a vulnerability scan run again a sample Windows 2008 Server.
Hands-on labStationX Membership
Cryptography: Breaking Weak RSA KeysCryptography Attack and DefenceDuration: 1 hStudents will be shown various tools for attacking and using RSA public key information.
Hands-on labStationX Membership
Cryptography: Password CrackingCryptography Attack and DefenceDuration: 1 hTraining on how to use GPG with a GPG challenge at the end.Hands-on labStationX Membership
Cryptography: Using GPG for Encryption and Key ManagementCryptography Attack and Defence + 2 more blocksDuration: 1 hTraining on how to use GPG with a GPG challenge at the end.Hands-on labStationX Membership
Data Backup to Prep for RecoveryCritical Security Controls + 6 more blocksDuration: 1 hIn this lab we will simulate the recovery phase where we must perform a backup in a server environment.Hands-on labStationX Membership
Data Downloads and ValidationCritical Security ControlsDuration: 1 hIn this lab, students will learn to validate downloads to mitigate risk.
Hands-on labStationX Membership
DNS as a Remote ShellIntro to Network Security & Traffic AnalysisDuration: 1 hThis lab exercise is designed to allow the trainee to become familiar with recognizing remote shells that operate using well known ports such as DNS.
Hands-on labStationX Membership
Event LogCyber Security FundamentalsDuration: 1 hIn this lab, the trainee will have the opportunity to review event log files associated with the Windows 7 operating system.
Hands-on labStationX Membership
Firewall Setup and ConfigurationCyber Defense Analyst Training Series + 7 more blocksDuration: 1 hIn this lab you will perform the steps necessary to set up a pfSense firewall from the basic command line interface and then configure the firewall using the web configuration GUI on a Windows…Hands-on labStationX Membership
Force Point: DLP Email OverviewCritical Security ControlsDuration: 1 hForcepoint DLP will teach the student how to configure Forcepoint DLP to stop data loss on the email channel.Hands-on labStationX Membership
Force Point: DLP Network OverviewCritical Security ControlsDuration: 1 hDLP network: Monitors and enforces DLP policies across several communication channels, including email, web, IM, network printing.Hands-on labStationX Membership
Host Data Integrity BaseliningCyber Security Fundamentals + 1 more blockDuration: 1 hIn this lab, trainees will explore the fundamentals of establishing file and directory baselines using both Kali Linux and Windows 11.Hands-on labStationX Membership
Identifying Key AssetsCritical Security ControlsDuration: 1 hStudents will use nmap to identify specific assets on their network.Hands-on labStationX Membership
Implementing Least-Privilege on WindowsCyber Security Professional + 2 more blocksDuration: 1 hLeast-privilege is an important concept across many domains (e.g., Windows server/workstation management, networking, Linux management, etc.) and requires great discipline to implement properly.Hands-on labStationX Membership
Leveraging Internal Intelligence ResourcesCritical Security ControlsDuration: 1 hStudents will leverage Zenmap and Tenable Nessus vulnerability scanner in order to perform an internal scan of networked resources.Hands-on labStationX Membership
Log Correlation & Analysis to Identify Potential IOCCritical Security Controls + 1 more blockDuration: 1 hWhen defending networked digital systems, attention must be paid to the logging mechanisms set in place to detect suspicious behavior.Hands-on labStationX Membership
Manually Creating a Baseline with MD5DeepCyber Defense Analyst Training Series + 3 more blocksDuration: 1 hStudents will create a baseline on a documents folder using md5deep.Hands-on labStationX Membership
MITRE - AttackCyber Security Fundamentals + 1 more blockDuration: 1 hThis lab demonstrates the process that Advanced Persistent Threat (APT) actors use to gain initial access to organizations using phishing campaigns and malicious documents.Hands-on labStationX Membership
MITRE - DefendCyber Security Fundamentals + 1 more blockDuration: 1 hThis lab is designed to teach defenders how to use Mitre ATT&CK and Mitre Navigator to research potential APTs that will target their organization and how to prioritize their defensive efforts.Hands-on labStationX Membership
Monitoring and Verifying Management SystemsCritical Security Controls + 6 more blocksDuration: 1 hIn this lab, students will use Nessus Essentials to assess a system for vulnerabilities and generate a detailed analysis report.Hands-on labStationX Membership
Network Segmentation (FW/DMZ/WAN/LAN)Cyber Defense Analyst Training Series + 8 more blocksDuration: 1 hCreate three distinct areas for this network, route traffic accordingly and lock down VPN access to the appropriate IP address.Hands-on labStationX Membership
Open and Close Ports on Windows 7Critical Security Controls + 1 more blockDuration: 1 hIn this lab, the student will kill some processes and close down some shares in response to a suspected threat.Hands-on labStationX Membership
Open Source Password CrackingCyber Security Fundamentals + 3 more blocksDuration: 1 hStudents will use John the Ripper and Cain and Abel to crack various password protected file types on a Windows machine.Hands-on labStationX Membership
Phishing (2026)Critical Security ControlsDuration: 1 hIn this hands-on lab, students will explore the fundamentals of phishing attacks and user awareness by using the Social-Engineer Toolkit (SET) to create a phishing email and simulate a real-world…Hands-on labStationX Membership
PhishingCritical Security Controls + 1 more blockDuration: 1 hStudents will send a phishing email using the Social Engineering Toolkit.Hands-on labStationX Membership
Post Incident Service RestorationCritical Security Controls + 1 more blockDuration: 1 hIn this lab, students will focus on the recovery phase of incident response by restoring critical services on a compromised host in a post-incident environment.Hands-on labStationX Membership
RansomwareCritical Security ControlsDuration: 1 hStudents will learn what ransomware is, observe how it works, and implement mitigation strategies to recover from a ransomware attack.Hands-on labStationX Membership
Recover from SQL Injection AttackCritical Security Controls + 1 more blockDuration: 1 hAfter identifying a SQL Injection attack, students will learn about parameterized queries in back-end web servers to minimize future SQLi attacks.
Hands-on labStationX Membership
Recovering Data and Data Integrity ChecksSecurity BaselineDuration: 1 hIn this lab, the student will establish a baseline of two pre-defined files, delete those files, and subsequently restore them.Hands-on labStationX Membership
Scanning From WindowsCyber Defense Forensics Analyst Training Series + 4 more blocksDuration: 1 hStudents will leverage Scalnline, a windows network discovery and mapping tool, to identify the systems on a network of responsibility.Hands-on labStationX Membership
Sensitive Information IdentificationCritical Security ControlsDuration: 1 hStudents will utilize Data Loss Prevention (DLP) software to identify documents potentially containing sensitive information.
Hands-on labStationX Membership
Setting Up Zones in a FirewallCyber Defense Incident Responder + 3 more blocksDuration: 1 hStudents will configure a pfSense Firewall to create/isolate various network segments.Hands-on labStationX Membership
Snorby Setup and OperationIntro to Network Security & Traffic AnalysisDuration: 1 hThis lab exercise is designed to expose trainees to perform an initial setup for Security Onion and to configure and install Snort and Snorby.Hands-on labStationX Membership
TCPDumpIntro to Network Security & Traffic AnalysisDuration: 1 hThis lab exercise is designed to allow the trainee become familiar with the basic command arguments and usage of TCPDump.Hands-on labStationX Membership
Tweaking Firewall Rules for DetectionCyber Defense Forensics Analyst Training Series + 3 more blocksDuration: 1 hStudents will use organizational firewall for monitoring, detecting and auditing traffic on the network.Hands-on labStationX Membership
Using Snort and Wireshark to Analyze TrafficCyber Defense Analyst Training Series + 5 more blocksDuration: 1 hIn this lab we will replicate the need for Analysts to be able to analyze network traffic and detect suspicious activity.Hands-on labStationX Membership
Vulnerability Identification and RemediationCritical Security Controls + 1 more blockDuration: 1 hLearners will use Nmap and OpenVAS/Greenbone Vulnerability Scanner to confirm old vulnerable systems and to also discover new ones.Hands-on labStationX Membership
Windows Deployment ServicesSecurity BaselineDuration: 1 hAs an incident responder, it's important to understand how to create baseline Windows templates.Hands-on labStationX Membership
Windows Event Log Manipulation via Windows Event ViewerCyber Defense Incident Responder + 4 more blocksDuration: 1 hIn this lab you will use Windows Event Viewer to view and filter the security event log on a Windows 7 client computer specifically for account logons.Hands-on labStationX Membership
WiresharkCyber Defense Forensics Analyst Training Series + 3 more blocksDuration: 1 hIn this hands-on lab, students will gain a foundational understanding of network traffic analysis using Wireshark.Hands-on labStationX Membership
Disable User Account on Windows 10Cyber Defense Analyst Training Series + 1 more blockDuration: 1 hIn this lab, the student will respond to a suspected insider threat incident by disabling user accounts in Windows.
Hands-on labStationX Membership
Using PowerShell to Analyze a SystemWindows Administration Fundamentals Duration: 1 hIn this lab, students will use PowerShell within a Windows Server 2025 environment to perform system enumeration and data analysis.Hands-on labStationX Membership
Advanced Techniques for Malware RecoveryCyber Defense Analyst Training Series + 1 more blockDuration: 1 hStudents will use the SysInternals Suite of utilities to analyze processes, DLLs, registry edits and other auto start functions to locate and remove malicious software from an infected Windows 7…Hands-on labStationX Membership
Analysis and Recommendation ReportCyber Defense Analyst Training Series + 1 more blockDuration: 1 hStudents will do a Vulnerability Assessment on a network.
Hands-on labStationX Membership
Analyze and Classify MalwareCyber Defense Analyst Training Series + 1 more blockDuration: 1 hIn this lab you will attempt to conduct basic analysis on some malware samples that were found on the internal network.Hands-on labStationX Membership
Analyze SQL Injection AttackCyber Defense Analyst Training Series + 3 more blocksDuration: 1 hStudents will Identify the use of an SQL Injection through the use of Wireshark.Hands-on labStationX Membership
Analyze Various Data Sources to Confirm Suspected InfectionCyber Defense Analyst Training Series + 1 more blockDuration: 1 hStudents will review network traffic to confirm the presence of malicious activity using various tools including Wireshark and VirusTotal.com.
Hands-on labStationX Membership
Assessing Vulnerabilities Post AddressalCyber Defense Analyst Training Series + 1 more blockDuration: 1 hStudents will use Snorby against multiple systems to identify and mitigate any vulnerabilities found.
Hands-on labStationX Membership
BitCoin Mining Web Application on Corporate NetworkThreat Intelligence & DefenseDuration: 1 hStudents will identify unauthorized activity on a corporate network.
Hands-on labStationX Membership
Conduct Log Analysis and Cross Examination for False PositivesDigital Media Forensics + 1 more blockDuration: 1 hStudents will confirm the validity of event-data analysis to eliminate false-positive events.Hands-on labStationX Membership
Conduct Root Cause Analysis for System CrashesCyber Defense Analyst Training Series + 4 more blocksDuration: 1 hStudents will use utilize a specially loaded system to conduct analysis on a captured memory dump from a machine suffering from repeating system crashes.Hands-on labStationX Membership
Conduct Supplemental MonitoringCyber Defense Forensics Analyst Training Series + 3 more blocksDuration: 1 hIn this lab you implement supplemental monitoring solutions on a network using various Microsoft security tools and built-ins.Hands-on labStationX Membership
Core Impact Web Application Penetration TestingCyber Defense Analyst Training Series + 1 more blockDuration: 1 hThis lab introduces students to the web application penetration testing suite within the Core Impact application.Hands-on labStationX Membership
Create Custom Snort RulesCyber Defense Analyst Training Series + 1 more blockDuration: 1 hYou will configure snort as an IDS.Hands-on labStationX Membership
Creating Recommendations Based on Vulnerability AssessmentsCyber Defense Analyst Training Series + 2 more blocksDuration: 1 hStudents will use nmap and OpenVAS / Greenbone Vulnerability Scanner to confirm old vulnerable systems and discover new ones.Hands-on labStationX Membership
Creating SIEM Reports with SplunkCyber Defense Analyst Training SeriesDuration: 1 hStudents will walk through the creation of SIEM reports using the SPLUNK tool.Hands-on labStationX Membership
Data Recovery with AutopsyCyber Defense Forensics Analyst Training Series + 2 more blocksDuration: 1 hStudents will ingest and process a previously acquired forensic image using Autopsy.Hands-on labStationX Membership
Dynamic Malware AnalysisCyber Defense Forensics Analyst Training Series + 2 more blocksDuration: 1 hStudents will use utilize two virtual machines, inside a protected network, to observe configuration changes on a known good / clean system and all of the unusual network traffic generated by the…Hands-on labStationX Membership
Entering Information into a CMDBThreat Intelligence & DefenseDuration: 1 hStudents will review an old asset list and enter all of the contained information into a Configuration Management Database (CMDB).Hands-on labStationX Membership
Event Logs with AutopsyThreat Intelligence & DefenseDuration: 1 hIn this hands-on lab, students will learn the fundamentals of Windows Event Logs, including their purpose, structure, and the types of information they contain.Hands-on labStationX Membership
Hash VerificationCyber Defense Forensics Analyst Training Series + 1 more blockDuration: 1 hIn this lab, students will understand and use hash verification to identify and compare files and forensic images.Hands-on labStationX Membership
Identify Whether High-Risk Systems Were AffectedCyber Defense Analyst Training Series + 4 more blocksDuration: 1 hThe highest risk systems are the ones with Internet facing Applications.Hands-on labStationX Membership
Identifying Malicious Network ConnectionsCyber Defense Analyst Training Series + 1 more blockDuration: 1 hWhen investigating a cybersecurity incident it's important to take memory snapshots of affected systems for further analysis.Hands-on labStationX Membership
IDS Setup and ConfigurationCyber Defense Analyst Training SeriesDuration: 1 hNetwork and host-based Intrusion Detection Systems (IDS) analyze traffic and provide log and alert data for detected events and activity. pfSense provides multiple IDS options including Host IDS and…Hands-on labStationX Membership
Implement Single System Changes in FirewallCyber Defense Analyst Training Series + 2 more blocksDuration: 1 hIn this lab, you will make changes to the pfSense firewall in order to block specific ports and types of traffic.Hands-on labStationX Membership
Internet HistoryThreat Intelligence & DefenseDuration: 1 hIn this lab, students will learn how to locate, extract, and analyze internet history artifacts from a forensic disk image.Hands-on labStationX Membership
Introduction to SquertCyber Defense Forensics Analyst Training Series + 1 more blockDuration: 1 hIn this lab, you will learn how to use Squert to view previously generated event data detected by the sensors.Hands-on labStationX Membership
Linux Users and GroupsCyber Defense Analyst Training Series + 1 more blockDuration: 1 hIn this lab students will use command line tools to create, modify, and manage users and groups within the Linux operating environment.Hands-on labStationX Membership
Log AnalysisCyber Defense Analyst Training Series + 2 more blocksDuration: 1 hIn this lab students will have the opportunity to review various log files associated with the Windows operating system.Hands-on labStationX Membership
Log CorrelationCyber Defense Analyst Training SeriesDuration: 1 hStudents will use Splunk to ingest server logs and a physical access log to determine if a physical security event has occurred, and if so, who may be behind it.Hands-on labStationX Membership
Log Event ReportsCyber Defense Forensics Analyst Training Series + 1 more blockDuration: 1 hIn this lab, students will identify and analyze event logs across multiple systems, learning where logs are stored and how to filter them for relevant events.Hands-on labStationX Membership
Manual Vulnerability AssessmentCyber Defense Analyst Training Series + 6 more blocksDuration: 1 hAs part of the defense in depth model it is vitally important to keep tabs on the events occurring on individual devices/systems.Hands-on labStationX Membership
Microsoft Baseline Security AnalyzerCyber Defense Analyst Training Series + 3 more blocksDuration: 1 hIn this lab you will use Microsoft Baseline Security Analyzer (MBSA) to perform scans of individual host computers and of groups of computers.Hands-on labStationX Membership
Monitoring for False PositivesCyber Defense Analyst Training Series + 1 more blockDuration: 1 hIn this lab we will map a drive to a share on the network and then copy resources from a file server.Hands-on labStationX Membership
Monitoring Network TrafficCyber Defense Analyst Training Series + 2 more blocksDuration: 1 hIn this hands-on lab, students will learn how to monitor and analyze network activity using a combination of industry-standard security tools.Hands-on labStationX Membership
Monitoring Network Traffic for Potential IOA/IOCCyber Security Professional + 1 more blockDuration: 1 hIn this lab we will replicate potentially malicious scans from the Internet against a corporate asset.Hands-on labStationX Membership
Nexpose: Red Team ExploitationThreat Intelligence & DefenseDuration: 1 hThe Nexpose red team exploitation lab exposes student to the impact of critical network threats from an attacker perspective.Hands-on labStationX Membership
Overview of KibanaCyber Defense Forensics Analyst Training Series + 2 more blocksDuration: 1 hStudents will become familiarized with data visualization using Kibana - one of the 3 tools included in Elastic's ELK stack, a trio of open-source applications that work together in order to meet a…Hands-on labStationX Membership
Parse Files Out of Network TrafficCyber Defense Analyst Training Series + 5 more blocksDuration: 1 hThis lab teach students how to extract various files from network traffic using Network Miner and Wireshark.Hands-on labStationX Membership
Performing an Initial Attack AnalysisThreat Intelligence & Defense + 1 more blockDuration: 1 hStudents will use perform incident response on a compromised machine.Hands-on labStationX Membership
Preliminary ScanningCyber Defense Analyst Training Series + 4 more blocksDuration: 1 hStudents will utilize Nmap, a network discovery and mapping tool, to identify the systems on a network of responsibility.Hands-on labStationX Membership
Preparing Target MediaThreat Intelligence & DefenseDuration: 1 hIn this lab, students will prepare target media for imaging using dc3dd and Disk Wipe.Hands-on labStationX Membership
Protect Against BeaconingCyber Defense Analyst Training Series + 4 more blocksDuration: 1 hStudents will take a PCAP indicating the presence of a beacon on the network and analyze it.
Hands-on labStationX Membership
QRadar - Centralized MonitoringQRadar SIEMDuration: 1 hThis lab will help the students understand common logs in linux and to configure a remote system to forward syslog events to a central location (QRadar).Hands-on labStationX Membership
QRadar - IDS Setup and ConfigurationQRadar SIEMDuration: 1 hOften the security analyst will need to update the existing IDS/IPS (Intrusion Detection/Prevention System) to handle new threats.Hands-on labStationX Membership
QRadar - Log Correlation & Analysis to Identify Potential IOCQRadar SIEMDuration: 1 hWhen defending networked digital systems, attention must be paid to the logging mechanisms set in place to detect suspicious behavior.Hands-on labStationX Membership
QRadar - Snort Signatures, IDS Tuning, and BlockingQRadar SIEMDuration: 1 hOften the security analyst will need to update the existing IDS/IPS (Intrusion Detection/Prevention System) to handle new threats.Hands-on labStationX Membership
Recover from Illegal Bitcoin Mining IncidentThreat Intelligence & DefenseDuration: 1 hStudents will conduct recovery activities using Indicators of Compromise found on the victim computer and other network-related artifacts.Hands-on labStationX Membership
Recover from Web-Based Flashpack IncidentThreat Intelligence & DefenseDuration: 1 hStudents will recover a Windows 7 client infected by an unknown payload loaded after exposure to the FlashPack Exploit Kit.Page 1 of 3 · Next →