Module 19: Trying Harder: The Labs

Challenges

Completing the SOC-200 Challenges

Each SOC-200 challenge is an isolated exercise that attempts to train security monitoring and detection by executing a number of attacks in real time, which must be detected and understood.

Across all challenges, the given scenario is that we perform the actions of a SOC analyst and make use of an Elastic-Logstash-Kibana (ELK) instance to perform detections.

For each challenge, a network topology is displayed to provide better understanding of the network we must protect. The network for each challenge attempts to simulate a corporate network and start out small; in later challenges, they grow in size and complexity.

Each phase contains one or more actions, which could be enumeration, initial compromise, persistence, or lateral movement. The task is to use log analysis in ELK to detect the actions and understand how the fictitious organization is being attacked.