User Experience Overview
Each scenario immerses users in a realistic investigative process designed to enhance their analytical skills through guided, hands-on interaction.
Core Experience Flow
Step 1: Scenario Selection & Onboarding
Users start by selecting a training scenario
An interactive onboarding tour introduces:
Platform navigation
Core features
Overall simulation flow
A scenario summary is presented, including:
Briefing
Hypothesis
Objectives
Points
Difficulty
After acknowledgment, users are redirected to the simulation environment:
The first stop is the Intel Page, where the hypothesis is presented alongside a more detailed briefing of the information available for the users to start the hunt
Users will need to build an attack chain based on the information given to them and their investigations in the SIEM and validate or disprove that hypothesis during the run
Step 2: Investigation Phase
Users engage with Splunk and VMs to:
Find each stages of the attack.
Document findings in real-time using the built-in attack chain stage creator
Step 3: Timeline & Attack Chain Construction
Users construct a chronological timeline of the incident.
They need to fill in the relevant information required to construct that attack chain.
Step 4: Submission & Feedback
Users submit their attack chain for review.
They determine if the Hypothesis is proven or disproven
A Threat hunting report is generated for the user based on the attack chain submitted for reference
When the user is happy and clicks on submit findings:
The simulator:
Grades the submission
A report is generated with:
Performance insights
Accuracy scoring
Key learning takeaways
TryHackMe