Read the log, not the answer key
Every case ships with the real artifact: an auth.log, an nginx access log, a CloudTrail export. Nothing is summarised for you and nothing is multiple choice.
Free SOC analyst training
Somebody got in at 02:17.
Work out how.
PracticeSIEM gives you real security incidents with the raw logs and a working search console. Practice SOC analyst skills in your browser. No account, no install, nothing to download.
Investigation, not a quiz
Each case is the work a SOC analyst does on a Tuesday, cut down to twenty minutes.
Search the way you will at work
The console takes field filters, comparisons and wildcards. Click a value in the field sidebar and it writes that filter into the search bar, so the syntax sticks.
Tasks that follow a real triage
Scope the noise, name the attacker, pin the timeline, then write the detection query that would have caught it before anyone paged you.
Eight log formats, parsed properly
Every field a SIEM would extract is filterable in the console.
auth.log · syslog
SSH auth, sudo, cron, service events
nginx access
Method, URI, status, query string, agent
BIND queries
Client, qname, record type, label length
Security events
Event ID, account, logon type, ticket encryption
AWS CloudTrail
Event name, assumed role, bucket, object key
UFW / iptables
Action, source, destination port, protocol
vsftpd transfers
Login, download path, bytes transferred
Integrity reports
CSV headers become filterable fields
Start here
Open cases, easiest first.
Frequently asked questions
Everything you need to know about training on PracticeSIEM.
What is PracticeSIEM?
PracticeSIEM is a hands-on, browser-based SOC analyst training simulator with 28 realistic security incident investigations. You get real log artifacts and a working Splunk-like query console to detect intruders, correlate alerts, and answer shift-lead questions.
Do I need to install Splunk, ELK, or VMs?
No. PracticeSIEM runs 100% in your browser. All log parsing, search filtering, and grading happen client-side with zero installations, zero virtual machines, and nothing to configure.
Which log sources and formats are supported?
PracticeSIEM parses eight production log formats: Linux syslog/auth.log, Nginx web access logs, BIND DNS queries, Windows Security Event Logs, AWS CloudTrail JSON, UFW/iptables firewalls, vsftpd FTP logs, and CSV integrity reports.
What kinds of security threats are covered?
Cases cover brute force attacks, credential stuffing, SQL injection, DNS tunneling, Kerberoasting, AWS IMDS SSRF, lateral movement, ransomware detection, and MITRE ATT&CK techniques across Enterprise and Cloud environments.
