Your investigation machine

A whole incident, frozen for you to investigate

This course runs on one Linux machine inside your browser. You are logged in as the analyst account student. The machine is not a victim — it is your workstation, preloaded with the evidence collected from a real intrusion that happened on 2026-03-10. Nothing here touches the network; investigate as freely as you like.

All the evidence lives under /srv/soc-data/, one folder per source:

ls /srv/soc-data
ls -R /srv/soc-data

In the terminal

student@vulntech:~$ ls /srv/soc-data
README.md  linux  network  nids  web  windows
student@vulntech:~$ ls -R /srv/soc-data
/srv/soc-data:
README.md  linux  network  nids  web  windows

/srv/soc-data/linux:
auth.log

/srv/soc-data/network:
capture.pcap

/srv/soc-data/nids:
conn.log  eve.json

/srv/soc-data/web:
access.log

/srv/soc-data/windows:
security.log

• linux/auth.log — the Linux server's SSH & sudo authentication log
• web/access.log — the web server's access log
• windows/security.log — exported Windows Security events (CSV)
• network/capture.pcap — a packet capture from the wire
• nids/ — Suricata alerts (eve.json) and Zeek connections (conn.log)

Tip: A SOC (Security Operations Centre) analyst's job is exactly this: take the evidence a detection throws up, work out what really happened, and write it down. Each module in this course takes one source; the same attacker runs through all of them.