Challenge your judgment across threat hunting, alert triage, detection engineering, incident reconstruction, forensics and recovery.
Focused challenges designed to test judgment, evidence handling and defensible security decisions.
Free, independent knowledge assessments. Review the scope, preparation and scoring before you begin. Suggested times are study guidance; passing can earn a Threat Intelligence Lab platform certificate, not an accredited or third-party vendor qualification.
Start with a course check, a source-based investigation or a specialist topic.
Choose a focused assessment aligned with practical course material, from security awareness and cloud security to incident response and software supply chains.
8 assessments Work from sources Investigate real threat reportingUse advisories, standards and technical documentation to answer evidence-led questions without overstating what the sources prove.
62 assessments Think like an analyst Test your intelligence tradecraftAssess requirements, evidence evaluation, analysis, structured intelligence, actor profiling and decision-focused communication.
17 assessments Detect and respond Practice operational security decisionsChallenge your judgment across threat hunting, alert triage, detection engineering, incident reconstruction, forensics and recovery.
22 assessments Protect modern systems Assess trust across connected systemsTest cloud evidence, identity threats, third-party exposure, software dependencies and trusted-release decisions.
28 assessments Follow the operation Trace malicious behavior and infrastructureAnalyze malware behavior, ransomware operations, command infrastructure, delivery chains and defensible investigative pivots.
53 assessmentsTrace a Phobos intrusion from exposed RDP and loader behavior through firewall changes, credential access, exfiltration, recovery inhibition, and ransom-note execution.
Review assessment : AA24-060A Phobos Intrusion Command and Exfiltration ResearchEvaluate an Ivanti Connect Secure intrusion where web shells, credential exposure, root persistence, and anti-forensic activity challenged normal appliance validation.
Review assessment : AA24-060B Ivanti Appliance Forensics and Integrity-Check AssessmentUse the SILENTSHIELD report to analyze parallel access paths, long dwell time, diversified implants, timestamp tampering, Sysmon visibility, and organizational response failures.
Review assessment : AA24-193A SILENTSHIELD Detection-Evasion InvestigationInvestigate the DPRK RGB 3rd Bureau's defense collection requirements, ransomware funding, web-server exploitation, custom RAT inventory, command habits, and packed tooling.
Review assessment : AA24-207A Andariel Espionage and Malware ResearchInvestigate Ghost's opportunistic exploitation, short dwell time, Cobalt Strike execution, encoded lateral movement, limited exfiltration, and recovery inhibition.
Review assessment : AA25-050A Ghost Ransomware Intrusion ResearchResearch Sigma's official rule format to interpret log sources, detection selections, conditions, field modifiers, status, severity, false positives, and portable rule intent.
Review assessment : Sigma Detection Rule Technical InvestigationUse Microsoft Defender XDR's official advanced-hunting schema to select event tables, interpret process and network fields, correlate unique events, and retrieve trustworthy signing evidence.
Review assessment : Microsoft Defender XDR Hunting Schema Investigation