🎛️ Preferences

Saved to your account, so they follow you to any device.

▶ Replay intro now 🧭 Take the portal tour

🎫 Ticket queue

🗑 Reset queue

Clears your ticket queue and restarts the drip from the scenario pack. Keeps XP, badges, notes, theme and profile.

❓ How it works

1. Queue: open a ticket from the Open tab. Read the claim and the IOCs.
2. Investigate: work out what would have to be true if the requester is genuine.
3. SIEM: search the logs and pin events. You need key evidence from at least 2 different sources.
4. Threat Intel: look up suspicious IPs and domains.
5. Resolve: back on the ticket, fill in classification, action, status, IOCs and a correlation note, then submit.

Hints & Solution

• Show hint gives up to 3 nudges, one at a time. Each hint costs 50 XP from that ticket's reward. Your grade is not affected.
• Solution shows the full walkthrough and turns the ticket into practice: it is closed as "Solved with guide", earns 0 XP, is not counted in your correctness %, and resets your streak.

XP & levels

XP = score × 10, minus hint costs. A pass (70+) builds your streak, and each streak step adds +50 XP. A level is every 500 XP.

Search tips

• Log Search uses a pipe-based query language: index=entra src_ip=198.51.100.23 | stats count by event_code. Click ❓ Query help in the SIEM for every supported command.
• Start with the username, then search any odd IP, domain or phone number you find.
• Look for one value that shows up in several sources. That is your correlation.
• Check what the real user is doing at the same time.

Golden rule

Never reset a password without verifying the person through a known channel. Doing so is an automatic fail.

Scoring

Classification 35 · Action/status 25 · Key details 20 · Evidence 20. No time limit: take the time you need. The pass mark is 70.

📁 My cases

Open the 💬 support chat and choose "Create a case" to reach the team.

🧰 Version & diagnostics

If something isn't working, copy this into your support case so we can see exactly what you're running.

Web app

…

📋 Copy diagnostics

™ Trademarks & notices

TWJ SOC is an independent training simulation. Its apps (TWJ Identity, TWJ Cloud Console, TWJ EDR, TWJ Mail Security, TWJ Directory, TWJ Edge Firewall, TWJ SIEM and TWJ SOAR) are mock-ups built from scratch to teach how real security tools are used. They contain synthetic data only. TWJ is not affiliated with, sponsored, authorized or endorsed by Microsoft Corporation, Amazon Web Services, Inc., CrowdStrike, Inc. or Splunk LLC / Cisco Systems, Inc. Product names are used only to describe what each simulation teaches.

Microsoft, Microsoft Entra, Microsoft Defender, Azure and Active Directory are trademarks of the Microsoft group of companies. AWS, Amazon Web Services, AWS CloudTrail, Amazon GuardDuty and related marks are trademarks of Amazon.com, Inc. or its affiliates. CrowdStrike and Falcon are trademarks of CrowdStrike, Inc. Splunk and Splunk SOAR are trademarks or registered trademarks of Splunk LLC, a Cisco company, in the United States and other countries. All other brand names, product names and trademarks belong to their respective owners.

Open-source notices

• SOAR app action and parameter names follow the open-source Splunk SOAR connectors (github.com/splunk-soar-connectors), licensed under the Apache License 2.0. Copyright Splunk Inc. No connector code is included.
• Python in SOAR custom functions runs on Pyodide (Mozilla Public License 2.0), bundled unmodified.

Full text: THIRD_PARTY_NOTICES.md in the lab source.