SOC simulation: alert triage and incident response drills
Players work an alert queue against the clock. They triage, search the logs, map findings to MITRE ATT&CK, escalate the right incidents and write the report. It's also called a blue team or SOC CTF. We don't sell it as a self-serve format: you describe who is playing and what you want to measure, we send a quote, and our team writes the scenario, runs the alert queue and log environment on the day, and judges the reports with you.
Illustrative alert queue from a managed SOC event (sample data)
What is a SOC simulation?
A SOC simulation is a hands-on exercise that recreates a security operations center shift. Participants work a queue of alerts generated from a realistic scenario, search logs to separate real threats from noise, investigate indicators of compromise and submit incident reports. Scoring is agreed with you before the event and rewards sound verdicts, clear reasoning and complete findings.
Where a jeopardy event asks "can you find the flag?", a blue team CTF asks "can you tell what happened, how bad it is and what to do next?" It is the defensive half of the red team vs blue team picture, and it is a core skill for analyst roles.
At a glance
- Players: individuals or teams
- Duration: sized to your event
- Skills: triage, log analysis, IOC work, reporting
- Scoring: agreed with you per event
- How you get one: a managed event run by our team, quoted per event
Blue team, SOC and DFIR competitions compared
Organizers use the three names loosely, but they describe different jobs. A blue team CTF is the umbrella: any defensive competition where players analyze evidence instead of attacking a target. A SOC CTF recreates analyst workflow, from queue to escalation. A DFIR CTF (digital forensics and incident response) asks players to reconstruct an incident from artifacts.
A CTF7 SOC simulation blends all three: the SOC queue for workflow, DFIR-style evidence for investigation, and CTF-style scoring and a leaderboard so it runs as an event. For a gentler start, add a forensics category to a jeopardy board first; our categories guide covers forensics.
| Format | What players do | How it is usually scored |
|---|---|---|
| Blue team CTF | Analyze logs, files or traffic to answer questions about an attack | A flag or answer per question; sometimes a judged report |
| SOC CTF | Work an alert queue: verdicts, severity, escalation and reports | Quality of each decision, as agreed for the event |
| DFIR CTF | Examine disk, memory, network and log artifacts to build a timeline | Answers such as the first malicious process or the attacker's entry point, plus a timeline in longer formats |
| A/D defense | Patch and monitor live services while rivals attack them | Defense and SLA points each tick, inside an attack-defense CTF |
How a SOC CTF runs, from briefing to debrief
Each event runs one scenario against one clock, in six steps.
Talk to the event teamBriefing and environment
Players meet the fictional organization: its network, key systems, users and escalation policy. They know what normal looks like before the first alert fires.
The alert queue opens
Alerts arrive over time, mixing real incident activity with the false positives every SOC deals with. Players claim alerts and set a verdict: true positive, false positive or needs escalation.
Investigate across the evidence
A SIEM-style search over simulated authentication, endpoint, email, proxy and cloud logs lets players pivot from one clue to the next, review reported phishing emails and collect IOCs.
Classify, map and escalate
Confirmed incidents get a severity, the relevant MITRE ATT&CK techniques and an escalation decision, just as an L1 analyst would hand over to L2 or incident response.
Submit the incident report
Each incident closes with a structured report: summary, timeline, affected assets, IOCs, techniques and recommended containment. Judges review the reports alongside the scenario answer key.
Score, rank and debrief
The leaderboard ranks teams on the scoring agreed for your event. After the clock stops, a walkthrough reveals the full attack story so every player sees what they caught and what they missed.
What analysts do during the exercise
Our team weights these building blocks for who is playing: a campus event leans on triage and phishing, an analyst assessment on investigation and reporting.
Alert triage queue
A realistic mix of true and false positives, arriving over time, with claim, verdict and escalate actions.
SIEM-style log search
Search and filter simulated telemetry across hosts, users and services to build the story behind an alert.
Phishing email review
Inspect user-reported emails, headers and links, decide if they are malicious and find who else received them.
IOC investigation
Collect and verify indicators such as domains, IP addresses, file hashes and accounts, and scope where else they appear.
MITRE ATT&CK mapping
Tag incidents with the tactics and techniques from the ATT&CK framework, checked against the scenario.
Severity & escalation
Rate each incident and decide who to wake up. Over-escalating noise is as much a mistake as missing a real incident.
Pivot from one clue to the next
Good analysts do not stop at the alert. A strange login leads to a host, the host leads to a process, the process leads to a domain, and the domain leads to two more affected accounts. The simulation rewards that chain of reasoning: finding the IOCs and affected assets through investigation is what separates a strong report from a thin one.
Judged on decisions as well as answers
A fast analyst who closes a real incident as noise has failed the shift. A blue team CTF should reward what a SOC lead rewards: the right verdict, a sensible severity, evidence that holds up and a report someone else can act on.
The scoring weights are fixed with you before the event, so a hiring round can weight reports heavily and a campus event can favor triage. Afterwards you receive the final ranking and every judged report.
What judges look at
- Correct calls on true and false positives
- Severity and escalation choices
- IOCs and affected assets found
- ATT&CK techniques mapped
- Clarity of the incident report
False positives are part of the test. Closing noise quickly and correctly frees time for the incidents that matter.
Blue team roles: L1, L2 and IR lead
Team events can mirror a SOC tier structure, so players practice the handoffs that go wrong in real incidents.
L1 analyst
Works the queue: first-look triage, verdicts, closing false positives and escalating anything real with clear notes.
L2 analyst
Takes escalations deeper: log pivots, IOC scoping, ATT&CK mapping and building the incident timeline.
IR lead
Owns the incident: confirms severity, decides containment recommendations and signs off the final report.
Judges & mentors
Review free-text reports and coach teams, with limited permissions.
Three incident scenarios
Every scenario is a complete story with a beginning, a noisy middle and a clear answer key. Themes can be adapted to your sector.
Monday morning, and the file server is renaming thousands of documents. Players work backwards from the loudest alert to find the quiet one that started it days earlier: a phishing email, a suspicious login and slow movement between machines. The question is not only "what is encrypted?" but "where did it start, and what else is at risk?"
- Initial access
- Lateral movement
- Impact
- Containment advice
An employee who just resigned is accessing projects they have never touched, at unusual hours. Nothing is technically blocked. Players must separate legitimate work from data collection, build a defensible timeline and write a report that HR and legal could act on, without jumping to conclusions.
- Collection
- Exfiltration
- Behavioral baselines
- Evidence handling
An access key was committed to a public repository. Hours later, unfamiliar activity appears in the cloud audit logs: new resources, a new admin identity, and an unusual storage download. Players trace what the key could reach, what was touched and which identities need rotating first.
- Credential access
- Persistence
- Cloud audit logs
- Scope & rotation
A 4-hour blue team CTF, step by step
| Time | What happens |
|---|---|
| 00:00 | Briefing: the fictional company, assets and escalation policy |
| 00:20 | Warm-up queue of 10 alerts to learn the interface |
| 00:45 | Main scenario starts; alerts arrive in waves |
| 02:15 | Second wave shifts the story; new incidents open |
| 03:15 | Queue closes; final incident reports due |
| 03:30 | Judges review reports; leaderboard finalized |
| 03:40 | Walkthrough of the full attack story and awards |
SOC simulation at a glance
| Mode | Individual or teams, online or on site |
|---|---|
| Evidence | Simulated auth, endpoint, email, proxy and cloud audit logs; sanitized artifacts only |
| Player tools | Alert queue, log search and report forms, set up and run by our team for your event |
| Scoring | Agreed with you before the event; judge review for written reports |
| After the event | Final ranking, judged reports and a walkthrough of the scenario |
| What the quote covers | Scenario writing or adaptation, the environment for the event window, our staff on the day, report judging |
| Availability | Managed event only, not part of the Free or Standard plans; ask for a quote |
Who runs SOC simulations
CTF7 runs a SOC simulation one event at a time, with no long-term license. Pick the audience closest to yours, then tell us your dates.
Where a SOC simulation fits in blue team training
Blue team training splits into two jobs: self-paced practice, and live, timed exercises that test what people practiced. A SOC simulation is the second job.
Practice first
Analysts build skill through steady, self-paced work: forensics categories on open jeopardy events, or our practice event, Ouroboros CTF (launching soon).
Then test it as an event
A SOC simulation puts everyone on one clock with a shared scenario, a leaderboard and a debrief, in front of peers, recruiters or a SOC lead. Registration runs on a CTF7 event page; the scenario itself is run by our team.
Not sure whether you need a range, a lab catalog or a competition? Our cyber range explainer shows where a range fits, and red team vs blue team covers how to design defensive exercises. To scope one, talk to us.
Our team also scopes and runs the other managed formats: attack-defense and King of the Hill. Self-serve events start from the format overview.
Scope a SOC drill
Tell us the size of the blue team and the tools your analysts already use, so the scenario feels familiar. We reply with the alert volume, the scenario outline and a quote.
